<html><head></head><body>The Asterisk Development Team would like to announce security releases for<br>Asterisk 13, 15 and 16. The available releases are released as versions 13.28.1,<br>15.7.4 and 16.5.1.<br><br>These releases are available for immediate download at<br><br><a href='https://downloads.asterisk.org/pub/telephony/asterisk/releases'>https://downloads.asterisk.org/pub/telephony/asterisk/releases</a><br><br>The following security vulnerabilities were resolved in these versions:<br><br><ul><li> AST-2019-004: Crash when negotiating for T.38 with a declined stream<br>When Asterisk sends a re-invite initiating T.38 faxing, and the endpoint<br>responds with a declined media stream a crash will then occur in Asterisk.<br></li><br><li> AST-2019-005: Remote Crash Vulnerability in audio transcoding<br>When audio frames are given to the audio transcoding support in Asterisk the<br>number of samples are examined and as part of this a message is output to<br>indicate that no samples are present. A change was done to suppress this<br>message for a particular scenario in which the message was not relevant. This<br>change assumed that information about the origin of a frame will always exist<br>when in reality it may not.<br></li></ul><br>For a full list of changes in the current releases, please see the ChangeLogs:<br><br><a href='https://downloads.asterisk.org/pub/telephony/asterisk/releases/ChangeLog-13.28.1'>ChangeLog-13.28.1</a><br><a href='https://downloads.asterisk.org/pub/telephony/asterisk/releases/ChangeLog-15.7.4'>ChangeLog-15.7.4</a><br><a href='https://downloads.asterisk.org/pub/telephony/asterisk/releases/ChangeLog-16.5.1'>ChangeLog-16.5.1</a><br><br>The security advisories are available at:<br><br><a href='https://downloads.asterisk.org/pub/security/AST-2019-004.pdf'>AST-2019-004.pdf</a><br><a href='https://downloads.asterisk.org/pub/security/AST-2019-005.pdf'>AST-2019-005.pdf</a><br><br>Thank you for your continued support of Asterisk!</body></html>