Debian alert DLA-4631-1 (asterisk)

From:
             
 
Thorsten Alteholz <debian@alteholz.de>
To:
             
 
debian-lts-announce@lists.debian.org
Subject:
             
 
[SECURITY] [DLA 4631-1] asterisk security update
Date:
             
 
Tue, 16 Jun 2026 17:09:09 +0000
Message-ID:
             
 
<79ef24dc-6c6a-1d94-47c7-9954b76746c@alteholz.de>
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

- -------------------------------------------------------------------------
Debian LTS Advisory DLA-4631-1                debian-lts@lists.debian.org
https://www.debian.org/lts/security/                    Thorsten Alteholz
June 16, 2026                                 https://wiki.debian.org/LTS
- -------------------------------------------------------------------------

Package        : asterisk
Version        : 1:16.28.0~dfsg-0+deb11u10
CVE ID         : CVE-2025-65102 CVE-2026-25994 CVE-2026-26203
                  CVE-2026-26967 CVE-2026-28799 CVE-2026-29068
                  CVE-2026-32942 CVE-2026-32945 CVE-2026-33069
                  CVE-2026-34235 CVE-2026-40614 CVE-2026-41415
                  CVE-2026-42225


Several issues have been found in asterisk, an Open Source Private Branch 
Exchange (PBX). They are related to buffer under- or overflows, either on 
heap or on stack. Some are related to use-after-free or wrong processing 
of invalid or untrusted certificates.


For Debian 11 bullseye, these problems have been fixed in version
1:16.28.0~dfsg-0+deb11u10.

We recommend that you upgrade your asterisk packages.

For the detailed security status of asterisk please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/asterisk

Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS
-----BEGIN PGP SIGNATURE-----

iQKTBAEBCgB9FiEEYgH7/9u94Hgi6ruWlvysDTh7WEcFAmoxgzVfFIAAAAAALgAo
aXNzdWVyLWZwckBub3RhdGlvbnMub3BlbnBncC5maWZ0aGhvcnNlbWFuLm5ldDYy
MDFGQkZGREJCREUwNzgyMkVBQkI5Njk2RkNBQzBEMzg3QjU4NDcACgkQlvysDTh7
WEfVzA/+PV6pAevzh5BOdktF53XUfjphAosf6JUdWuiK4VzqJslfIHi/GhmL8fi3
tEaZzHuc/alTjRf1gF9tLSDeVgzumpoOarM9CXD7D9uu+/2zqFvmAg0NzdMCvknv
tKb0+DvEK8S3goYQhmKYkC5OdeDz9BWRwC/R0WDqfVxD1/zF1yeJTzaDeO5jKpMa
zX8XBeA59YVXuLD8s3L9/MeczMHNzbppWIUzhEATbo//ikebDSInspVzKwB+K7Ry
TUijcaNwVc3xBZQYhr1U44hs6q+KuXwCw5RLvycJhybjXKB6ezrVqKT5IYnO5mCk
MdkpHcKRVUNC2GNswbgWZkC80Dx3LLa2msuookZrT7NrnAzg7E093jKyqAr5UJ91
JgQ/IUAhWw7qjR1l7SeI3rBYuMi3TYHYJN2szEuox0vzUPsbRU6o/RhkXj+wqEEu
pnXA4u8piIryLXbaBA5j0pIXbWo92jg7ZsdKHMU/gKciqbxHCRRU9xqW2k5J8YJd
JT8+MB8Pz/FqI1eCvLD6fVwebH0mbx1jR9nGc+VEC9dBjsj+/wW5JQ2vyTtq09lT
oAc4f854NK+UMNXn+Gv+mict8uJB6Wy2X90Q8fukOoadavYP90hzO1Ngyalv3Kmk
pVGgp0vT1VG0A3MPBSKwqtBUZIOTatf90jeT34O4hq4bqqtuSaw=
=T6BP
-----END PGP SIGNATURE-----