Log message:
Upgrade to 1.6.2.18.  This fixes several security issues including:
AST-2011-002, AST-2011-003, AST-2011-004, AST-2011-005, and AST-2011-006.

===========================================================================
1.6.2.18:

The Asterisk Development Team has announced the release of Asterisk 1.6.2.18.

The release of Asterisk 1.6.2.18 resolves several issues reported by the
community and would have not been possible without your participation.
Thank you!

The following is a sample of the issues resolved in this release:

 * Only offer codecs both sides support for directmedia.

 * Resolution of several DTMF based attended transfer issues.
   NOTE: Be sure to read the ChangeLog for more information about these changes.

 * Resolve deadlocks related to device states in chan_sip

 * Fix channel redirect out of MeetMe() and other issues with channel softhangup

 * Fix voicemail sequencing for file based storage.

 * Guard against retransmitting BYEs indefinitely during attended transfers with
   chan_sip.

In addition to the changes listed above, commits to resolve security issues
AST-2011-005 and AST-2011-006 have been merged into this release. More
information about AST-2011-005 and AST-2011-006 can be found at:

http://downloads.asterisk.org/pub/security/AST-2011-005.pdf
http://downloads.asterisk.org/pub/security/AST-2011-006.pdf

For a full list of changes in this release, please see the ChangeLog:

http://downloads.asterisk.org/pub/telephony/asterisk/ChangeLog-1.6.2.18

===========================================================================
1.6.2.17.3

The Asterisk Development Team has announced security releases for Asterisk
branches 1.4, 1.6.1, 1.6.2, and 1.8. The available security releases are
released as versions 1.4.40.1, 1.6.1.25, 1.6.2.17.3, and 1.8.3.3.

The releases of Asterisk 1.4.40.1, 1.6.1.25, 1.6.2.17.3, and 1.8.3.3 resolve two
issues:

* File Descriptor Resource Exhaustion (AST-2011-005)
* Asterisk Manager User Shell Access (AST-2011-006)

The issues and resolutions are described in the AST-2011-005 and AST-2011-006
security advisories.

For more information about the details of these vulnerabilities, please read the
security advisories AST-2011-005 and AST-2011-006, which were released at the
same time as this announcement.

For a full list of changes in the current releases, please see the ChangeLog:

http://downloads.asterisk.org/pub/telephony/asterisk/releases/ChangeLog-1.6.2.17.3

Security advisory AST-2011-005 and AST-2011-006 are available at:

http://downloads.asterisk.org/pub/security/AST-2011-005.pdf
http://downloads.asterisk.org/pub/security/AST-2011-006.pdf

===========================================================================
1.6.2.17.2:

The Asterisk Development Team has announced security releases for Asterisk
branches 1.6.1, 1.6.2, and 1.8. The available security releases are
released as versions 1.6.1.24, 1.6.2.17.2, and 1.8.3.2.

** This is a re-release of Asterisk 1.6.1.23, 1.6.2.17.1 and 1.8.3.1 which
    contained a bug which caused duplicate manager entries (issue #18987).

The releases of Asterisk 1.6.1.24, 1.6.2.17.2, and 1.8.3.2 resolve two issues:

  * Resource exhaustion in Asterisk Manager Interface (AST-2011-003)
  * Remote crash vulnerability in TCP/TLS server (AST-2011-004)

The issues and resolutions are described in the AST-2011-003 and AST-2011-004
security advisories.

For more information about the details of these vulnerabilities, please read the
security advisories AST-2011-003 and AST-2011-004, which were released at the
same time as this announcement.

For a full list of changes in the current releases, please see the ChangeLog:

http://downloads.asterisk.org/pub/telephony/asterisk/releases/ChangeLog-1.6.2.17.2

Security advisory AST-2011-003 and AST-2011-004 are available at:

http://downloads.asterisk.org/pub/security/AST-2011-003.pdf
http://downloads.asterisk.org/pub/security/AST-2011-004.pdf

===========================================================================
1.6.2.17.1:

The Asterisk Development Team has announced security releases for Asterisk
branches 1.6.1, 1.6.2, and 1.8. The available security releases are
released as versions 1.6.1.23, 1.6.2.17.1, and 1.8.3.1.

These releases are available for immediate download at
http://downloads.asterisk.org/pub/telephony/asterisk/releases

The releases of Asterisk 1.6.1.23, 1.6.2.17.1, and 1.8.3.1 resolve two issues:

  * Resource exhaustion in Asterisk Manager Interface (AST-2011-003)
  * Remote crash vulnerability in TCP/TLS server (AST-2011-004)

The issues and resolutions are described in the AST-2011-003 and AST-2011-004
security advisories.

For more information about the details of these vulnerabilities, please read the
security advisories AST-2011-003 and AST-2011-004, which were released at the
same time as this announcement.

For a full list of changes in the current releases, please see the ChangeLog:

http://downloads.asterisk.org/pub/telephony/asterisk/releases/ChangeLog-1.6.2.17.1

Security advisory AST-2011-003 and AST-2011-004 are available at:

http://downloads.asterisk.org/pub/security/AST-2011-003.pdf
http://downloads.asterisk.org/pub/security/AST-2011-004.pdf

===========================================================================
1.6.2.16.2:

The Asterisk Development Team has announced security releases for Asterisk
branches 1.4, 1.6.1, 1.6.2, and 1.8. The available security releases are
released as versions 1.4.39.2, 1.6.1.22, 1.6.2.16.2, and 1.8.2.4.

The releases of Asterisk 1.4.39.2, 1.6.1.22, 1.6.2.16.2, and 1.8.2.4 resolve an
issue that when decoding UDPTL packets, multiple stack and heap based arrays can
be made to overflow by specially crafted packets. Systems configured for
T.38 pass through or termination are vulnerable. The issue and resolution are
described in the AST-2011-002 security advisory.

For more information about the details of this vulnerability, please read the
security advisory AST-2011-002, which was released at the same time as this
announcement.

For a full list of changes in the current release, please see the ChangeLog:

http://downloads.asterisk.org/pub/telephony/asterisk/releases/ChangeLog-1.6.2.16.2

Security advisory AST-2011-002 is available at:

http://downloads.asterisk.org/pub/security/AST-2011-002.pdf

Log message:
recursive bump from gettext-lib shlib bump.

Log message:
Update to 1.6.2.16.1

This is to fix AST-2011-001: Stack buffer overflow in SIP channel driver

               Asterisk Project Security Advisory - AST-2011-001

         Product        Asterisk
         Summary        Stack buffer overflow in SIP channel driver
    Nature of Advisory  Exploitable Stack Buffer Overflow
      Susceptibility    Remote Authenticated Sessions
         Severity       Moderate
      Exploits Known    No
       Reported On      January 11, 2011
       Reported By      Matthew Nicholson
        Posted On       January 18, 2011
     Last Updated On    January 18, 2011
     Advisory Contact   Matthew Nicholson <mnicholson at digium.com>
         CVE Name

   Description When forming an outgoing SIP request while in pedantic mode, a
               stack buffer can be made to overflow if supplied with
               carefully crafted caller ID information. This vulnerability
               also affects the URIENCODE dialplan function and in some
               versions of asterisk, the AGI dialplan application as well.
               The ast_uri_encode function does not properly respect the size
               of its output buffer and can write past the end of it when
               encoding URIs.

For full details, see:

http://downloads.digium.com/pub/security/AST-2011-001.html

Log message:
Update to 1.6.2.16:

The release of Asterisk 1.6.2.16 resolves several issues reported by the
community and would have not been possible without your participation.
Thank you!

The following is a sample of the issues resolved in this release:

* Fix cache of device state changes for multiple servers.
   (Closes issue #18284, #18280. Reported, tested by klaus3000. Patched, tested
   by russellb)

* Resolve issue where channel redirect function (CLI or AMI) hangs up the call
   instead of redirecting the call.
   (Closes issue #18171. Reported by: SantaFox)
   (Closes issue #18185. Reported by: kwemheuer)
   (Closes issue #18211. Reported by: zahir_koradia)
   (Closes issue #18230. Reported by: vmarrone)
   (Closes issue #18299. Reported by: mbrevda)
   (Closes issue #18322. Reported by: nerbos)

* Linux and *BSD disagree on the elements within the ucred structure. Detect
   which one is in use on the system.
   (Closes issue #18384. Reported, patched, tested by bjm, tilghman)

* app_followme: Don't create a Local channel if the target extension does not
   exist.
   (Closes issue #18126. Reported, patched by junky)

* Revert code that changed SSRC for DTMF.
   (Closes issue #17404, #18189, #18352. Reported by sdolloff, marcbou. rsw686.
   Tested by cmbaker82)

* Resolve issue where REGISTER request with a Call-ID matching an existing
   transaction is received it was possible that the REGISTER request would
   overwrite the initreq of the private structure.
   (Closes issue #18051. Reported by eeman. Patched, tested by twilson)

For a full list of changes in this release, please see the ChangeLog:

http://downloads.asterisk.org/pub/telephony/asterisk/ChangeLog-1.6.2.16

Log message:
Update to 1.6.2.15.  This is primarily a bugfix release.
- disable automatic Lua detection for now until lang/lua/builtin.mk exists

The release of Asterisk 1.6.2.15 resolves several issues reported by the
community and would have not been possible without your participation.
Thank you!

The following is a sample of the issues resolved in this release:

* When using chan_skinny, don't crash when parking a non-bridged call.
   (Closes issue #17680. Reported, tested by jmhunter. Patched, tested by DEA)

* Add ability for Asterisk to try both the encoded and unencoded subscription
   URI for a match in hints.
   (Closes issue #17785. Reported, tested by ramonpeek. Patched by tilghman)

* Set the caller id on CDRs when it is set on the parent channel.
   (Closes issue #17569. Reported, patched by tbelder)

* Ensure user portion of SIP URI matches dialplan when using encoded characters
   (Closes issue #17892. Reported by wdoekes. Patched by jpeeler)

* Resolve issue where Party A in an analog 3-way call would continue to hear
   ringback after party C answers.
   (Patched by rmudgett)

* Fix problem with qualify option packets for realtime peers never stopping.
   The option packets not only never stopped, but if a realtime peer was not in
   the peer list multiple options dialogs could accumulate over time.
   (Closes issue #16382. Reported by lftsy. Tested by zerohalo. Patched by
   jpeeler)

* Multiple fixes related to Local channels.

For a full list of changes in this release, please see the ChangeLog:

http://downloads.asterisk.org/pub/telephony/asterisk/ChangeLog-1.6.2.15

Log message:
The stop and reload commands require the core prefix now.

Log message:
Update to 1.6.2.14

The release of Asterisk 1.6.2.14 resolves several issues reported by the
community and would have not been possible without your participation.
Thank you!

The following is a sample of the issues resolved in this release:

 * Fix issue where session timers would be advertised as supported even
   when session-timers=refuse was set in sip.conf. Also fix
   interoperability problems with session timer behavior in Asterisk.
   (Closes issue #17005. Reported by alexcarey. Patched by dvossel)

 * Parse all "Accept" headers for SIP SUBSCRIBE requests.
   (Closes issue #17758. Reported by ibc. Patched by dvossel)

 * Fix issue where queue stats would be reset on reload.
   (Closes issue #17535. Reported by raarts. Patched by tilghman)

 * Fix issue where MoH files were no longer rescanned on during a
   reload.
   (Closes issue #16744. Reported by pj. Patched by Qwell)

 * Fix issue with dialplan pattern matching where the specificity for
   pattern ranges and pattern characters was inconsistent.
   (Closes issue #16903. Reported, patched by Nick_Lewis)

For a full list of changes in the current release, please see the
ChangeLog:

http://downloads.asterisk.org/pub/telephony/asterisk/ChangeLog-1.6.2.14

Log message:
Add -n to startup options, so starting Asterisk doesn't mess with screen
colours.

Log message:
Adjust rc.d script to disable colour when issuing commands to Asterisk.

Log message:
DISTFILES is now initialized in Makefile, don't re-initialize it here.