bwh: (Default)

There is a potential buffer overflow in logging of CAPI messages in libcapi20 (part of isdnutils; bug 408530). The same broken code from libcapi20 is present in the Linux kernel (bug 411294). Also, the affected functions are not thread-safe and are unlikely to be made so without API changes; multithreaded programs calling them must use a mutex to avoid another security flaw; (such as asterisk-chan-capi; bug 411293).

I have prepared updates of asterisk-chan-capi and isdnutils for sarge and sid but I have no ISDN hardware to test them with. I would appreciate it if users of these packages would test the updates and report their results to the associated bugs.

The patches can be found attached to the bug reports. Updated packages are at:

deb http://womble.decadent.org.uk/debian/ distribution/
deb-src http://womble.decadent.org.uk/debian/ distribution/

(the repository is signed with my personal GPG key).

February 2011

S M T W T F S
  12345
6789101112
13141516171819
20212223 242526
2728     

Syndicate

RSS Atom

Most Popular Tags

Style Credit

Expand Cut Tags

No cut tags
Page generated Jun. 25th, 2017 08:53 am
Powered by Dreamwidth Studios