Gregory Massel

**Name of the Vulnerable Software and Affected Versions** Sangoma Asterisk versions 16.x through 16.16.1 Sangoma Asterisk versions 17.x through 17.9.2 Sangoma Asterisk versions 18.x through 18.2.1 Certified Asterisk versions prior to 16.8-cert7 **Description** The issue allows an attacker to trigger a crash by sending an m=image line and zero port in a response to a T.38 re-invite initiated by Asterisk. This occurs because there is an append operation relative to the active topology, but this should instead be a replace operation. **Recommendations** For Sangoma Asterisk versions 16.x through 16.16.1, update to version 16.16.2 or later. For Sangoma Asterisk versions 17.x through 17.9.2, update to version 17.9.3 or later. For Sangoma Asterisk versions 18.x through 18.2.1, update to version 18.2.2 or later. For Certified Asterisk versions prior to 16.8-cert7, update to version 16.8-cert7 or later.

**Name of the Vulnerable Software and Affected Versions** Sangoma Asterisk versions 16.x through 16.16.0 Sangoma Asterisk versions 17.x through 17.9.1 Sangoma Asterisk versions 18.x through 18.2.0 Certified Asterisk versions prior to 16.8-cert6 **Description** An issue was discovered in Sangoma Asterisk. When re-negotiating for T.38, if the initial remote response was delayed, Asterisk would send both audio and T.38 in the SDP. If this happened and the remote responded with a declined T.38 stream, then Asterisk would crash. **Recommendations** For Sangoma Asterisk versions 16.x through 16.16.0, update to version 16.16.1 or later. For Sangoma Asterisk versions 17.x through 17.9.1, update to version 17.9.2 or later. For Sangoma Asterisk versions 18.x through 18.2.0, update to version 18.2.1 or later. For Certified Asterisk versions prior to 16.8-cert6, update to version 16.8-cert6 or later.

**Name of the Vulnerable Software and Affected Versions** Sangoma Asterisk versions 13.21-cert4 through 15.7.3 Sangoma Asterisk versions 16.5.0 **Description** The issue allows an attacker to trigger a crash by sending a declined stream in a response to a T.38 re-invite initiated by Asterisk. The crash occurs because of a NULL session media object dereference. **Recommendations** For Sangoma Asterisk versions 13.21-cert4 through 15.7.3, update to version 15.7.4 or later. For Sangoma Asterisk version 16.5.0, update to version 16.5.1 or later.

**Name of the Vulnerable Software and Affected Versions** Asterisk versions 13.28.0 and 16.5.0 **Description** The issue allows a remote attacker to send a specific RTP packet during a call and cause a crash in a specific scenario. This occurs due to a problem in the main/translate.c file of the affected software. **Recommendations** For Asterisk version 13.28.0, update to a version that fixes this issue. For Asterisk version 16.5.0, update to a version that fixes this issue. At the moment, there is no information about a newer version that contains a fix for this vulnerability.