[asterisk-dev] Asterisk 13.18.5, 14.7.5, 15.1.5 and 13.18-cert2 Now Available (Security)

[Asterisk Development Team]

The Asterisk Development Team would like to announce security releases for
Asterisk 13, 14 and 15, and Certified Asterisk 13.18. The available releases are
released as versions 13.18.5, 14.7.5, 15.1.5 and 13.18-cert2.

These releases are available for immediate download at

https://downloads.asterisk.org/pub/telephony/asterisk/releases
https://downloads.asterisk.org/pub/telephony/certified-asterisk/releases

The following security vulnerabilities were resolved in these versions:

* AST-2017-014: Crash in PJSIP resource when missing a contact header
  A select set of SIP messages create a dialog in Asterisk. Those SIP messages
  must contain a contact header. For those messages, if the header was not
  present and using the PJSIP channel driver, it would cause Asterisk to crash.
  The severity of this vulnerability is somewhat mitigated if authentication is
  enabled. If authentication is enabled a user would have to first be authorized
  before reaching the crash point.

For a full list of changes in the current releases, please see the ChangeLogs:

https://downloads.asterisk.org/pub/telephony/asterisk/releases/ChangeLog-13.18.5
https://downloads.asterisk.org/pub/telephony/asterisk/releases/ChangeLog-14.7.5
https://downloads.asterisk.org/pub/telephony/asterisk/releases/ChangeLog-15.1.5
https://downloads.asterisk.org/pub/telephony/certified-asterisk/releases/ChangeLog-certified-13.18-cert2

The security advisory is available at:

https://downloads.asterisk.org/pub/security/AST-2017-014.pdf

Thank you for your continued support of Asterisk!
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.digium.com/pipermail/asterisk-dev/attachments/20171222/4f8e7101/attachment.html>