Posted by Asterisk Development Team on Dec 19

The earlier announcement should not have had any User or Upgrade notes.

The Asterisk Development Team would like to announce security release
Asterisk 21.0.1.

The release artifacts are available for immediate download at
https://github.com/asterisk/asterisk/releases/tag/21.0.1
and
https://downloads.asterisk.org/pub/telephony/asterisk

The following security advisories were resolved in this release:
– [Path traversal via AMI GetConfig allows…

Read More

Posted by Asterisk Development Team on Dec 19

The earlier release announcement should NOT have had any User or Upgrade
notes.

The Asterisk Development Team would like to announce security release
Certified Asterisk 18.9-cert6.

The release artifacts are available for immediate download at
https://github.com/asterisk/asterisk/releases/tag/certified-18.9-cert6
and
https://downloads.asterisk.org/pub/telephony/certified-asterisk

The following security advisories were resolved in this release:…

Read More

Posted by Sandro Gauci on Dec 19

# RTPEngine susceptible to Denial of Service via DTLS Hello packets during call initiation

– Fixed versions: mr12.1.1.2, mr12.0.1.3, mr11.5.1.16, mr10.5.6.3, mr10.5.6.2
– Enable Security Advisory: https://github.com/EnableSecurity/advisories/tree/master/ES2023-03-rtpengine-dtls-hello-race
– Vendor Patch: https://github.com/sipwise/rtpengine/commit/e969a79428ac4a15cdf1c0a1c6f266dbdc7e60b6
– Tested vulnerable versions: mr11.5.1.6
– Timeline:…

Read More

Posted by Sandro Gauci on Dec 19

# Asterisk susceptible to Denial of Service via DTLS Hello packets during call initiation

– Fixed versions: 18.20.1, 20.5.1, 21.0.1,18.9-cert6
– Enable Security Advisory: https://github.com/EnableSecurity/advisories/tree/master/ES2023-01-asterisk-dtls-hello-race
– Vendor Security Advisory: https://github.com/asterisk/asterisk/security/advisories/GHSA-hxj9-xwr8-w8pq
– Other references: CVE-2023-49786
– Tested vulnerable versions: 20.1.0
-…

Read More

Posted by Egidio Romano on Dec 19

———————————————————————————
PKP-WAL <= 3.4.0-3 (NativeImportExportPlugin) Remote Code Execution
Vulnerability
———————————————————————————

[-] Software Links:

https://pkp.sfu.ca
https://github.com/pkp/pkp-lib

[-] Affected Versions:

PKP Web Application Library (aka PKP-WAL or pkp-lib) version 3.4.0-3
and prior versions, as used in Open…

Read More

Posted by SBA – Advisory via Fulldisclosure on Dec 19

# MOKOSmart MKGW1 Gateway Improper Session Management #

Link:
https://github.com/sbaresearch/advisories/tree/public/2022/SBA-ADV-20220120-01_MOKOSmart_MKGW1_Gateway_Improper_Session_Management

## Vulnerability Overview ##

MOKOSmart MKGW1 Gateway devices with firmware version 1.1.1 or below do
not provide an adequate session management for the administrative web
interface. This allows adjacent attackers with access to the management
network to…

Read More

Posted by Apple Product Security via Fulldisclosure on Dec 19

APPLE-SA-12-19-2023-1 macOS Sonoma 14.2.1

macOS Sonoma 14.2.1 addresses the following issues.
Information about the security content is also available at
https://support.apple.com/kb/HT214048.

Apple maintains a Security Updates page at
https://support.apple.com/HT201222 which lists recent
software updates with security advisories.

WindowServer
Available for: macOS Sonoma
Impact: A user who shares their screen may unintentionally share the…

Read More

Posted by Balgogan via Fulldisclosure on Dec 19

**Introduction**

MajorDoMo, a beacon in Russian home automation and particularly favored by Raspberry Pi aficionados, has been a trusted
name for over a decade. With over 380 stars on its official GitHub repository at the time of writing
(https://github.com/sergejey/majordomo), its popularity is evident. However, lurking within its `thumb.php` module is a
severe unauthenticated Remote Code Execution (RCE) vulnerability before 0662e5e.
NOTE:…

Read More

FEDORA-EPEL-2023-4138b387a7

Packages in this update:

php-adodb-5.22.7-1.el8

Update description:

5.22.7, fix for CVE-2021-3850

Read More

FEDORA-EPEL-2023-2ff4055b33

Packages in this update:

php-Smarty-3.1.48-2.el7

Update description:

Fixed Cross site scripting vulnerability in Javascript escaping. This addresses CVE-2023-28447

Read More