Hi,

The following vulnerability was published for asterisk.

CVE-2025-65102[0]:
| PJSIP is a free and open source multimedia communication library.
| Prior to version 2.16, Opus PLC may zero-fill the input frame as
| long as the decoder ptime, while the input frame length, which is
| based on stream ptime, may be less than that. This issue affects
| PJSIP users who use the Opus audio codec in receiving direction. The
| vulnerability can lead to unexpected application termination due to
| a memory overwrite. This issue has been patched in version 2.16.

https://github.com/pjsip/pjproject/security/advisories/GHSA-w5vr-39x7-h8g5
https://github.com/pjsip/pjproject/commit/6e9bd2e7d25bba26f852771b40693f45da14fa8f


If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2025-65102
https://www.cve.org/CVERecord?id=CVE-2025-65102

Please adjust the affected versions in the BTS as needed.

We believe that the bug you reported is fixed in the latest version of
asterisk, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 1135620@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Jonas Smedegaard <dr@jones.dk> (supplier of updated asterisk package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)
Format: 1.8
Date: Fri, 26 Jun 2026 18:37:56 +0200
Source: asterisk
Architecture: source
Version: 1:22.10.0+dfsg+~cs6.17.60671434-2
Distribution: unstable
Urgency: medium
Maintainer: Debian VoIP Team <pkg-voip-maintainers@lists.alioth.debian.org>
Changed-By: Jonas Smedegaard <dr@jones.dk>
Closes: 1135620
Changes:
 asterisk (1:22.10.0+dfsg+~cs6.17.60671434-2) unstable; urgency=medium
 .
   * use debhelper compatibility level 14 (not 13)
   * update copyright info:
     + drop unused License section
       (duplicate of HPND-sell-variant bogusly labeled MIT)
     + update coverage
   * add solved CVEs to previous changelog entries;
     closes: bug#1135620, thanks to Thorsten Alteholz
   * update source helper tool copyright-check
Checksums-Sha1:
 7044342771c72bd1817526e460211ac867dac526 5389 asterisk_22.10.0+dfsg+~cs6.17.60671434-2.dsc
 1db4a0d1692add8fffba939cafdc8f4b8f85f2eb 125996 asterisk_22.10.0+dfsg+~cs6.17.60671434-2.debian.tar.xz
 e692780b21855735619d513ba3e6c8679d42c54d 25519 asterisk_22.10.0+dfsg+~cs6.17.60671434-2_amd64.buildinfo
Checksums-Sha256:
 02cfa61fcd2d89a9114f7a0c99ed263d9eb6e86085ccac0b6f4016a0b7902b66 5389 asterisk_22.10.0+dfsg+~cs6.17.60671434-2.dsc
 366b58222d33144584df8f77d92367e00b279962f1710dc5c76e32aef87353bc 125996 asterisk_22.10.0+dfsg+~cs6.17.60671434-2.debian.tar.xz
 4d8822468983a13f3b906e4f221c317ef0b45a9ea8a05b3ed91eed821f7c402d 25519 asterisk_22.10.0+dfsg+~cs6.17.60671434-2_amd64.buildinfo
Files:
 b6b376008412d9959067afd7c59bd757 5389 comm optional asterisk_22.10.0+dfsg+~cs6.17.60671434-2.dsc
 39fe05b35d21654b238835e330ccef8d 125996 comm optional asterisk_22.10.0+dfsg+~cs6.17.60671434-2.debian.tar.xz
 c85ade22f17524206ebf95977e2cd581 25519 comm optional asterisk_22.10.0+dfsg+~cs6.17.60671434-2_amd64.buildinfo
-----BEGIN PGP SIGNATURE-----

iQJABAEBCgAqFiEEn+Ppw2aRpp/1PMaELHwxRsGgASEFAmo+v2EMHGRyQGpvbmVz
LmRrAAoJECx8MUbBoAEh6ncQAIrnS0nz5Jnnqb8vKyrhmU4Wmpi8cTxcXLEdnGO1
HEgNnDfEL7IH01WENJAlSAt31FD51WhYFs61Gwyr+y5xew0PNtzMpKlkB43alXFX
eYg3Eell03aETLAnPgBXXtRgH3RWFLAR8PqTAdtbvqabW6DWjS5ANSDzwiAaFMFl
9W4PRZzsb84fS7ha7qNrQVAvKmgKzhJMDV1I5nWafz4TNWeXaj5M3qeaKs63h8dB
G+paMK0y4IZP6KJf9tA+IGW78zV5DsBnqLMtphSXTKVywAsYxFIMyThupmiX/mKJ
ZVJ76mwuVXa8SGFpuWL54GZV6md38TCZxOONJJcrMzDB1IrKLDKuvrU/JEiyVMjM
y/t+PCjYk1Jm/XOeHdudmKr4nt0VBdHLi1tEfo7gcx4lQXrIxISjXyhcMbb4osDg
/B+JFCaZtAz2x3MP4u5djPHP2qrTmA1E7VMwsJ7XOJTDcD8nqOd4MZ6/+9wKHuQN
jAmBWkToVnnyEm8z/3Gsu8ZL7qtu6MSywaiUfD05byFQsHIrg8Q/9Tb8aIuk61jA
bXleu10TAEoWd75HujRLfOqHOJxmohrw1qGNjmJg9/16CU81lP/l7z2laBtG9LLC
Goo8JN3SCUoR11n1tuZW7MnlJqZqi3koe5uajYN/X7dh7ffFhHetaayur73RqRq+
buwv
=HCSk
-----END PGP SIGNATURE-----