# changelog

author: Jeffrey C. Ollie <jeff@ocjtech.us> - 2.4.0-1
changelog:
  -
  - In addition to several bug fixes, the most significant changes from the
  - 2.3.0 release are:
  -
  - General DAHDI Changes:
  -
  - * Added DAHDI_MAINT_ALARM_SIM maintenance mode for drivers that
  -  support alarm simulation (wct4xxp).  This is only used by
  -  dahdi_maint and doesn't change the ABI.
  -
  - * Span callbacks are moved out of the dahdi_span structure potentially
  -  saving memory when a single driver implements multiple spans.
  -
  - Changes to dahdi-tools:
  -
  - * dahdi_maint: Added support for simulating alarm conditions.
  -
  - * dahdi_scan: Report more detailed alarm information.
  -
  - * xpp_fxloader:
  -  - Load firmware in the background
  -  - Support 1163 twinstar devices
  -  - A delay loop for older kernels (e.g. 2.6.18)
  -
  - * astribank_is_starting does not depend on libusb.
  -
  - * Allow using CONNECTOR/LABEL in genconf_parameters for pri_termtype
  -
  - For a full list of changes in these releases, please see the ChangeLogs at
  - http://svn.asterisk.org/svn/dahdi/linux/tags/2.4.0/ChangeLog and
  - http://svn.asterisk.org/svn/dahdi/tools/tags/2.4.0/ChangeLog


author: <jeff@ocjtech.us> - 2.4.1-1
changelog:
  - The Asterisk Development Team is pleased to announce the release of
  - DAHDI-Linux and DAHDI-Tools version 2.4.1.
  -
  - DAHDI-Linux 2.4.1, DAHDI-Tools 2.4.1, and DAHDI-Linux-Complete 2.4.1+2.4.1 are
  - available for immediate download at:
  - http://downloads.asterisk.org/pub/telephony/dahdi-linux
  - http://downloads.asterisk.org/pub/telephony/dahdi-tools
  - http://downloads.asterisk.org/pub/telephony/dahdi-linux-complete
  -
  - 2.4.1 is a maintenance release of the DAHDI drivers and tools packages. Some of
  - the more notable changes are:
  -
  - * Support for compilation against kernel versions from 2.6.9 up to and including
  -  2.6.38-rc6.
  -
  - * wct4xxp: PCI-express cards go through an extended reset at start by default.
  -
  - * wcte12xp, wctdm24xxp: Disable read-line multiple PCI command, which increases
  -  compatibility in some systems.
  -
  - * xpp: Fixes init error for PRI devices with < 4 ports.
  -
  - * tonezone: Add Macao, China to tone zone data.
  -
  - * dahdi_genconf: Don't generate configurations that use channel 16 on E1 CAS.
  -
  - For a full list of changes in these releases, please see the ChangeLogs at
  - http://svn.asterisk.org/svn/dahdi/linux/tags/2.4.1/ChangeLog and
  - http://svn.asterisk.org/svn/dahdi/tools/tags/2.4.1/ChangeLog
  -
  - Issues found in these release candidates can be reported in the DAHDI-linux or
  - DAHDI-tools project at https://issues.asterisk.org


author: <jeff@ocjtech.us> - 1.6.2.16.2-1
changelog:
  -
  -              Asterisk Project Security Advisory - AST-2011-002
  -
  -       Product       Asterisk
  -       Summary       Multiple array overflow and crash vulnerabilities in
  -                     UDPTL code
  -  Nature of Advisory Exploitable Stack and Heap Array Overflows
  -    Susceptibility   Remote Unauthenticated Sessions
  -       Severity      Critical
  -    Exploits Known   No
  -     Reported On     January 27, 2011
  -     Reported By     Matthew Nicholson
  -      Posted On      February 21, 2011
  -   Last Updated On   February 21, 2011
  -   Advisory Contact  Matthew Nicholson <mnicholson@digium.com>
  -       CVE Name
  -
  -  Description When decoding UDPTL packets, multiple stack and heap based
  -              arrays can be made to overflow by specially crafted packets.
  -              Systems doing T.38 pass through or termination are vulnerable.
  -
  -  Resolution The UDPTL decoding routines have been modified to respect the
  -             limits of exploitable arrays.
  -
  -             In asterisk versions not containing the fix for this issue,
  -             disabling T.38 support will prevent this vulnerability from
  -             being exploited. T.38 support can be disabled in chan_sip by
  -             setting the t38pt_udptl option to "no" (it is off by default).
  -
  -             t38pt_udptl = no
  -
  -             The chan_ooh323 module should also be disabled by adding the
  -             following line in modles.conf.
  -
  -             noload => chan_ooh323
  -
  -                              Affected Versions
  -               Product              Release Series
  -        Asterisk Open Source            1.4.x      All versions
  -        Asterisk Open Source            1.6.x      All versions
  -      Asterisk Business Edition         C.x.x      All versions
  -             AsteriskNOW                 1.5       All versions
  -     s800i (Asterisk Appliance)         1.2.x      All versions
  -
  -                                 Corrected In
  -             Product                               Release
  -       Asterisk Open Source        1.4.39.2, 1.6.1.22, 1.6.2.16.2, 1.8.2.4
  -    Asterisk Business Edition                      C.3.6.3
  -
  -                                   Patches
  -                                  URL                                 Branch
  -  http://downloads.asterisk.org/pub/security/AST-2011-002-1.4.diff    1.4
  -  http://downloads.asterisk.org/pub/security/AST-2011-002-1.6.1.diff  1.6.1
  -  http://downloads.asterisk.org/pub/security/AST-2011-002-1.6.2.diff  1.6.2
  -  http://downloads.asterisk.org/pub/security/AST-2011-002-1.8.diff    1.8
  -
  -         Links
  -
  -  Asterisk Project Security Advisories are posted at
  -  http://www.asterisk.org/security
  -
  -  This document may be superseded by later versions; if so, the latest
  -  version will be posted at
  -  http://downloads.digium.com/pub/security/AST-2011-002.pdf and
  -  http://downloads.digium.com/pub/security/AST-2011-002.html
  -
  -                               Revision History
  -       Date                Editor                    Revisions Made
  -  02/21/11        Matthew Nicholson         Initial Release
  -
  -              Asterisk Project Security Advisory - AST-2011-002
  -             Copyright (c) 2011 Digium, Inc. All Rights Reserved.
  - Permission is hereby granted to distribute and publish this advisory in its
  -                          original, unaltered form.


author: <jeff@ocjtech.us> - 1.6.2.17-1
changelog:
  - The Asterisk Development Team has announced the release of Asterisk 1.6.2.17.
  - This release is available for immediate download at
  - http://downloads.asterisk.org/pub/telephony/asterisk/
  -
  - The release of Asterisk 1.6.2.17 resolves several issues reported by the
  - community and would have not been possible without your participation.
  - Thank you!
  -
  - The following is a sample of the issues resolved in this release:
  -
  - * Resolve duplicated data in the AstDB when using DIALGROUP()
  -  (Closes issue #18091. Reported by bunny. Patched by tilghman)
  -
  - * Correct issue where res_config_odbc could populate fields with invalid data.
  -  (Closes issue #18251, #18279. Reported by bcnit, zerohalo. Tested by trev,
  -  jthurman, elguero, zerohalo. Patched by tilghman)
  -
  - * When using cdr_pgsql the billsec field was not populated correctly on
  -  unanswered calls.
  -  (Closes issue #18406. Reported by joscas. Patched by tilghman)
  -
  - * Resolve issue where re-transmissions of SUBSCRIBE could break presence.
  -  (Closes issue #18075. Reported by mdu113. Patched by twilson)
  -
  - * Fix regression causing forwarding voicemails to not work with file storage.
  -  (Closes issue #18358. Reported by cabal95. Patched by jpeeler)
  -
  - * This version of Asterisk includes the new Compiler Flags option
  -  BETTER_BACKTRACES which uses libbfd to search for better symbol information
  -  within both the Asterisk binary, as well as loaded modules, to assist when
  -  using inline backtraces to track down problems.
  -  (Patched by tilghman)
  -
  - * Resolve several issues with DTMF based attended transfers.
  -  (Closes issues #17999, #17096, #18395, #17273. Reported by iskatel, gelo,
  -  shihchaun, grecco. Patched by rmudgett).
  -  NOTE: Be sure to read the ChangeLog for more information about these changes.
  -
  - * Resolve issue where no Music On Hold may be triggered when using
  -  res_timing_dahdi.
  -  (Closes issues #18262. Reported by francesco_r. Patched by cjacobson. Tested
  -  by francesco_r, rfrantik, one47)
  -
  - * Fix regression that changed behavior of queues when ringing a queue member.
  -  (Closes issue #18747, #18733. Reported by vrban. Patched by qwell.)
  -
  - Additionally, this release has the changes related to security bulletin
  - AST-2011-002 which can be found at
  - http://downloads.asterisk.org/pub/security/AST-2011-002.pdf
  -
  - For a full list of changes in this release, please see the ChangeLog:
  -
  - http://downloads.asterisk.org/pub/telephony/asterisk/ChangeLog-1.6.2.17


author: Jeffrey C. Ollie <jeff@ocjtech.us> - 1.6.2.17.2-1
changelog:
  - The Asterisk Development Team has announced security releases for Asterisk
  - branches 1.6.1, 1.6.2, and 1.8. The available security releases are
  - released as versions 1.6.1.24, 1.6.2.17.2, and 1.8.3.2.
  -
  - These releases are available for immediate download at
  - http://downloads.asterisk.org/pub/telephony/asterisk/releases
  -
  - ** This is a re-release of Asterisk 1.6.1.23, 1.6.2.17.1 and 1.8.3.1 which
  -   contained a bug which caused duplicate manager entries (issue #18987).
  -
  - The releases of Asterisk 1.6.1.24, 1.6.2.17.2, and 1.8.3.2 resolve two issues:
  -
  -  * Resource exhaustion in Asterisk Manager Interface (AST-2011-003)
  -  * Remote crash vulnerability in TCP/TLS server (AST-2011-004)
  -
  - The issues and resolutions are described in the AST-2011-003 and AST-2011-004
  - security advisories.
  -
  - For more information about the details of these vulnerabilities, please read the
  - security advisories AST-2011-003 and AST-2011-004, which were released at the
  - same time as this announcement.
  -
  - For a full list of changes in the current releases, please see the ChangeLog:
  -
  - http://downloads.asterisk.org/pub/telephony/asterisk/releases/ChangeLog-1.6.1.24
  - http://downloads.asterisk.org/pub/telephony/asterisk/releases/ChangeLog-1.6.2.17.2
  - http://downloads.asterisk.org/pub/telephony/asterisk/releases/ChangeLog-1.8.3.2
  -
  - Security advisory AST-2011-003 and AST-2011-004 are available at:
  -
  - http://downloads.asterisk.org/pub/security/AST-2011-003.pdf
  - http://downloads.asterisk.org/pub/security/AST-2011-004.pdf


author: Jeffrey C. Ollie <jeff@ocjtech.us> - 1.6.2.17.3-1
changelog:
  - The Asterisk Development Team has announced security releases for Asterisk
  - branches 1.4, 1.6.1, 1.6.2, and 1.8. The available security releases are
  - released as versions 1.4.40.1, 1.6.1.25, 1.6.2.17.3, and 1.8.3.3.
  -
  - These releases are available for immediate download at
  - http://downloads.asterisk.org/pub/telephony/asterisk/releases
  -
  - The releases of Asterisk 1.4.40.1, 1.6.1.25, 1.6.2.17.3, and 1.8.3.3 resolve two
  - issues:
  -
  - * File Descriptor Resource Exhaustion (AST-2011-005)
  - * Asterisk Manager User Shell Access (AST-2011-006)
  -
  - The issues and resolutions are described in the AST-2011-005 and AST-2011-006
  - security advisories.
  -
  - For more information about the details of these vulnerabilities, please read the
  - security advisories AST-2011-005 and AST-2011-006, which were released at the
  - same time as this announcement.
  -
  - For a full list of changes in the current releases, please see the ChangeLog:
  -
  - http://downloads.asterisk.org/pub/telephony/asterisk/releases/ChangeLog-1.4.40.1
  - http://downloads.asterisk.org/pub/telephony/asterisk/releases/ChangeLog-1.6.1.25
  - http://downloads.asterisk.org/pub/telephony/asterisk/releases/ChangeLog-1.6.2.17.3
  - http://downloads.asterisk.org/pub/telephony/asterisk/releases/ChangeLog-1.8.3.3
  -
  - Security advisory AST-2011-005 and AST-2011-006 are available at:
  -
  - http://downloads.asterisk.org/pub/security/AST-2011-005.pdf
  - http://downloads.asterisk.org/pub/security/AST-2011-006.pdf


author: Jeffrey C. Ollie <jeff@ocjtech.us> - 1.6.2.18-1
changelog:
  -
  - The Asterisk Development Team has announced the release of Asterisk 1.6.2.18.
  - This release is available for immediate download at
  - http://downloads.asterisk.org/pub/telephony/asterisk/
  -
  - The release of Asterisk 1.6.2.18 resolves several issues reported by the
  - community and would have not been possible without your participation.
  - Thank you!
  -
  - The following is a sample of the issues resolved in this release:
  -
  -  * Only offer codecs both sides support for directmedia.
  -   (Closes issue #17403. Reported, patched by one47)
  -
  -  * Resolution of several DTMF based attended transfer issues.
  -   (Closes issue #17999, #17096, #18395, #17273. Reported by iskatel, gelo,
  -   shihchuan, grecco. Patched by rmudgett)
  -   NOTE: Be sure to read the ChangeLog for more information about these changes.
  -
  -  * Resolve deadlocks related to device states in chan_sip
  -   (Closes issue #18310. Reported, patched by one47. Patched by jpeeler)
  -
  -  * Fix channel redirect out of MeetMe() and other issues with channel softhangup
  -   (Closes issue #18585. Reported by oej. Tested by oej, wedhorn, russellb.
  -   Patched by russellb)
  -
  -  * Fix voicemail sequencing for file based storage.
  -   (Closes issue #18498, #18486. Reported by JJCinAZ, bluefox. Patched by
  -   jpeeler)
  -
  -  * Guard against retransmitting BYEs indefinitely during attended transfers with
  -   chan_sip.
  -   (Review: https://reviewboard.asterisk.org/r/1077/)
  -
  - In addition to the changes listed above, commits to resolve security issues
  - AST-2011-005 and AST-2011-006 have been merged into this release. More
  - information about AST-2011-005 and AST-2011-006 can be found at:
  -
  - http://downloads.asterisk.org/pub/security/AST-2011-005.pdf
  - http://downloads.asterisk.org/pub/security/AST-2011-006.pdf
  -
  - For a full list of changes in this release, please see the ChangeLog:
  -
  - http://downloads.asterisk.org/pub/telephony/asterisk/ChangeLog-1.6.2.18


author: Jeffrey C. Ollie <jeff@ocjtech.us> - 1.6.2.18.1-1
changelog:
  - The Asterisk Development Team has announced the release of Asterisk versions
  - 1.4.41.1, 1.6.2.18.1, and 1.8.4.3, which are security releases.
  -
  - These releases are available for immediate download at
  - http://downloads.asterisk.org/pub/telephony/asterisk/releases
  -
  - The release of Asterisk 1.4.41.1, 1.6.2.18, and 1.8.4.3 resolves several issues
  - as outlined below:
  -
  - * AST-2011-008: If a remote user sends a SIP packet containing a null,
  -  Asterisk assumes available data extends past the null to the
  -  end of the packet when the buffer is actually truncated when
  -  copied.  This causes SIP header parsing to modify data past
  -  the end of the buffer altering unrelated memory structures.
  -  This vulnerability does not affect TCP/TLS connections.
  -  -- Resolved in 1.6.2.18.1 and 1.8.4.3
  -
  - * AST-2011-009: A remote user sending a SIP packet containing a Contact header
  -  with a missing left angle bracket (<) causes Asterisk to
  -  access a null pointer.
  -  -- Resolved in 1.8.4.3
  -
  - * AST-2011-010: A memory address was inadvertently transmitted over the
  -  network via IAX2 via an option control frame and the remote party would try
  -  to access it.
  -  -- Resolved in 1.4.41.1, 1.6.2.18.1, and 1.8.4.3
  -
  -
  - The issues and resolutions are described in the AST-2011-008, AST-2011-009, and
  - AST-2011-010 security advisories.
  -
  - For more information about the details of these vulnerabilities, please read
  - the security advisories AST-2011-008, AST-2011-009, and AST-2011-010, which were
  - released at the same time as this announcement.
  -
  - For a full list of changes in the current releases, please see the ChangeLog:
  -
  - http://downloads.asterisk.org/pub/telephony/asterisk/releases/ChangeLog-1.4.41.1
  - http://downloads.asterisk.org/pub/telephony/asterisk/releases/ChangeLog-1.6.2.18.1
  - http://downloads.asterisk.org/pub/telephony/asterisk/releases/ChangeLog-1.8.4.3
  -
  - Security advisories AST-2011-008, AST-2011-009, and AST-2011-010 are available
  - at:
  -
  - http://downloads.asterisk.org/pub/security/AST-2011-008.pdf
  - http://downloads.asterisk.org/pub/security/AST-2011-009.pdf
  - http://downloads.asterisk.org/pub/security/AST-2011-010.pdf


author: Jeffrey C. Ollie <jeff@ocjtech.us> - 1.6.2.19-0.1:
changelog:
  - The Asterisk Development Team has announced the first release
  - candidate of Asterisk 1.6.2.19. This release candidate is available
  - for immediate download at
  - http://downloads.asterisk.org/pub/telephony/asterisk/
  -
  - Please note that Asterisk 1.6.2.19 will be the final maintenance
  - release from the 1.6.2 branch. Support for security related issues
  - will continue for one additional year. For more information about
  - support of the various Asterisk branches, see
  - https://wiki.asterisk.org/wiki/display/AST/Asterisk+Versions
  -
  - The release of Asterisk 1.6.2.19-rc1 resolves several issues reported
  - by the community and would have not been possible without your
  - participation.  Thank you!
  -
  - The following is a sample of the issues resolved in this release candidate:
  -
  - * Don't broadcast FullyBooted to every AMI connection The FullyBooted
  -  event should not be sent to every AMI connection every time someone
  -  connects via AMI. It should only be sent to the user who just
  -  connected.  (Closes issue #18168. Reported, patched by FeyFre)
  -
  - * Fix thread blocking issue in the sip TCP/TLS implementation.
  -  (Closes issue #18497. Reported by vois. Tested by vois, rossbeer,
  -  kowalma, Freddi_Fonet. Patched by dvossel)
  -
  - * Don't delay DTMF in core bridge while listening for DTMF features.
  -  (Closes issue #15642, #16625. Reported by jasonshugart,
  -  sharvanek. Tested by globalnetinc, jde. Patched by oej, twilson)
  -
  - * Fix chan_local crashs in local_fixup() Thanks OEJ for tracking down
  -  the issue and submitting the patch.  (Closes issue #19053. Reported,
  -  patched by oej)
  -
  - * Don't offer video to directmedia callee unless caller offered it as
  -  well (Closes issue #19195. Reported, patched by one47)
  -
  - For a full list of changes in this release candidate, please see the
  - ChangeLog:
  -
  - http://downloads.asterisk.org/pub/telephony/asterisk/ChangeLog-1.6.2.19-rc1


author: Jeffrey C. Ollie <jeff@ocjtech.us> - 1.6.2.19-1:
changelog:
  - The Asterisk Development Team has announced the final maintenance release of
  - Asterisk, version 1.6.2.19. This release is available for immediate download at
  - http://downloads.asterisk.org/pub/telephony/asterisk/
  -
  - Please note that Asterisk 1.6.2.19 is the final maintenance release from the
  - 1.6.2 branch. Support for security related issues will continue until April 21,
  - 2012. For more information about support of the various Asterisk branches, see
  - https://wiki.asterisk.org/wiki/display/AST/Asterisk+Versions
  -
  - The release of Asterisk 1.6.2.19 resolves several issues reported by the
  - community and would have not been possible without your participation.
  - Thank you!
  -
  - The following is a sample of the issues resolved in this release:
  -
  - * Don't broadcast FullyBooted to every AMI connection
  -  The FullyBooted event should not be sent to every AMI connection
  -  every time someone connects via AMI. It should only be sent to
  -  the user who just connected.
  -  (Closes issue #18168. Reported, patched by FeyFre)
  - * Fix thread blocking issue in the sip TCP/TLS implementation.
  -  (Closes issue #18497. Reported by vois. Tested by vois, rossbeer, kowalma,
  -  Freddi_Fonet. Patched by dvossel)
  - * Don't delay DTMF in core bridge while listening for DTMF features.
  -  (Closes issue #15642, #16625. Reported by jasonshugart, sharvanek. Tested by
  -  globalnetinc, jde. Patched by oej, twilson)
  - * Fix chan_local crashs in local_fixup()
  -  Thanks OEJ for tracking down the issue and submitting the patch.
  -  (Closes issue #19053. Reported, patched by oej)
  - * Don't offer video to directmedia callee unless caller offered it as well
  -  (Closes issue #19195. Reported, patched by one47)
  -
  - Additionally security announcements AST-2011-008, AST-2011-010, and
  - AST-2011-011 have been resolved in this release.
  -
  - For a full list of changes in this release, please see the ChangeLog:
  -
  - http://downloads.asterisk.org/pub/telephony/asterisk/ChangeLog-1.6.2.19


author: Jeffrey C. Ollie <jeff@ocjtech.us> - 1.6.2.20-1:
changelog:
  - The Asterisk Development Team announces the release of Asterisk 1.6.2.20. This
  - release is available for immediate download at
  - http://downloads.asterisk.org/pub/telephony/asterisk/
  -
  - The release of Asterisk 1.6.2.20 resolves a regression that was introduced just
  - prior to the release of Asterisk 1.6.2.19.
  -
  - * Fix reload crash caused by destroying default parking lot.
  -  (Closes issue ASTERISK-18103. Reported by 808blogger. Patched by jrose.
  -
  - For a full list of changes in this release, please see the ChangeLog:
  -
  - http://downloads.asterisk.org/pub/telephony/asterisk/releases/ChangeLog-1.6.2.20


