asterisk: multiple vulnerabilities
| Package(s): | asterisk | CVE #(s): | CVE-2011-1174 CVE-2011-1175 | ||||||||||||||||
| Created: | March 31, 2011 | Updated: | April 27, 2011 | ||||||||||||||||
| Description: | From the Red Hat Bugzilla [1, 2]: CVE-2011-1174: If manger connections were rapily opened, sent invalid data, then closed, it could cause Asterisk to exhaust available CPU and memory resources. The Manager Interface is disabled by default. Versions 1.6.2.x and 1.8.x are affected, and 1.6.2.17.1 and 1.8.3.1 have been released to correct this flaw. CVE-2011-1175: If a remote, unauthenticated, attacker were to rapidly open and close TCP connections to services using the ast_tcptls_* API, they could cause Asterisk to crash after dereferencing a NULL pointer. This flaw affects 1.6.2.x and 1.8.x, and is corrected in 1.6.2.17.1 and 1.8.3.1. | ||||||||||||||||||
| Alerts: |
| ||||||||||||||||||