The Asterisk Development Team would like to announce security releases for Asterisk 13, 14 and 15, and Certified Asterisk 13.18. The available releases are released as versions 13.18.5, 14.7.5, 15.1.5 and 13.18-cert2.

These releases are available for immediate download at

https://downloads.asterisk.org/pub/telephony/asterisk/releases https://downloads.asterisk.org/pub/telephony/certified-asterisk/releases

The following security vulnerabilities were resolved in these versions:

* AST-2017-014: Crash in PJSIP resource when missing a contact header
A select set of SIP messages create a dialog in Asterisk. Those SIP messages
must contain a contact header. For those messages, if the header was not
present and using the PJSIP channel driver, it would cause Asterisk to crash.
The severity of this vulnerability is somewhat mitigated if authentication is
enabled. If authentication is enabled a user would have to first be authorized
before reaching the crash point.

For a full list of changes in the current releases, please see the ChangeLogs:

https://downloads.asterisk.org/pub/telephony/asterisk/releases/ChangeLog-13.18.5
https://downloads.asterisk.org/pub/telephony/asterisk/releases/ChangeLog-14.7.5
https://downloads.asterisk.org/pub/telephony/asterisk/releases/ChangeLog-15.1.5
https://downloads.asterisk.org/pub/telephony/certified-asterisk/releases/ChangeLog-certified-13.18-cert2

The security advisory is available at:

https://downloads.asterisk.org/pub/security/AST-2017-014.pdf

Thank you for your continued support of Asterisk!