[asterisk-dev] Asterisk 13.27.1, 15.7.3, 16.4.1 and 13.21-cert4 Now Available (Security)

[Asterisk Development Team]

The Asterisk Development Team would like to announce security releases for
Asterisk 13, 15 and 16, and Certified Asterisk 13.21. The available releases are
released as versions 13.27.1, 15.7.3, 16.4.1 and 13.21-cert4.

These releases are available for immediate download at

https://downloads.asterisk.org/pub/telephony/asterisk/releases
https://downloads.asterisk.org/pub/telephony/certified-asterisk/releases

The following security vulnerabilities were resolved in these versions:

* AST-2019-002: Remote crash vulnerability with MESSAGE messages
  A specially crafted SIP in-dialog MESSAGE message can cause Asterisk to crash.

* AST-2019-003: Remote Crash Vulnerability in chan_sip channel driver
  When T.38 faxing is done in Asterisk a T.38 reinvite may be sent to an
  endpoint to switch it to T.38. If the endpoint responds with an improperly
  formatted SDP answer including both a T.38 UDPTL stream and an audio or video
  stream containing only codecs not allowed on the SIP peer or user a crash will
  occur. The code incorrectly assumes that there will be at least one common
  codec when T.38 is also in the SDP answer.

For a full list of changes in the current releases, please see the ChangeLogs:

https://downloads.asterisk.org/pub/telephony/asterisk/releases/ChangeLog-13.27.1
https://downloads.asterisk.org/pub/telephony/asterisk/releases/ChangeLog-15.7.3
https://downloads.asterisk.org/pub/telephony/asterisk/releases/ChangeLog-16.4.1
https://downloads.asterisk.org/pub/telephony/certified-asterisk/releases/ChangeLog-certified-13.21-cert4

The security advisories are available at:

https://downloads.asterisk.org/pub/security/AST-2019-002.pdf
https://downloads.asterisk.org/pub/security/AST-2019-003.pdf

Thank you for your continued support of Asterisk!
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.digium.com/pipermail/asterisk-dev/attachments/20190711/4a5c43d6/attachment.html>