CVE-2011-0495
Stack-based buffer overflow in the ast_uri_encode function in main/utils.c in Asterisk Open Source before 1.4.38.1, 1.4.39.1, 1.6.1.21, 1.6.2.15.1, 1.6.2.16.1, 1.8.1.2, 1.8.2.; and Business Edition before C.3.6.2; when running in pedantic mode allows remote authenticated users to execute arbitrary code via crafted caller ID data in vectors involving the (1) SIP channel driver, (2) URIENCODE dialplan function, or (3) AGI dialplan function.
- EPSS
- 4.2% chance of exploitation in the next 30 days; higher than 90% of CVEs (scores of 2026-10-31)
- CWE
- CWE-787
- Published
- Modified
- Record from
- the NVD, synced
Affected
- debian:debian_linux
- digium:asterisk
- digium:asterisknow
- digium:s800i_firmware
- fedoraproject:fedora
References
- http://downloads.asterisk.org/pub/security/AST-2011-001-1.6.2.diff
- http://downloads.asterisk.org/pub/security/AST-2011-001.html
- http://lists.fedoraproject.org/pipermail/package-announce/2011-February/053689.html
- http://lists.fedoraproject.org/pipermail/package-announce/2011-February/053713.html
- http://osvdb.org/70518