main/translate.c in Sangoma Asterisk 13.28.0 and 16.5.0 allows a remote attacker to send a specific RTP packet during a call and cause a crash in a specific scenario.
https://euvd.enisa.europa.eu/vulnerability/EUVD-2019-6591
http://packetstormsecurity.com/files/154372/Asterisk-Project-Security-Advisory-AST-2019-005.html
http://downloads.asterisk.org/pub/security/AST-2019-005.html