CVE-2011-0495: Debian Linux

Medium severity, CVSS 6.0. EPSS: 4.2% chance of exploitation in the next 30 days.

Stack-based buffer overflow in the ast_uri_encode function in main/utils.c in Asterisk Open Source before 1.4.38.1, 1.4.39.1, 1.6.1.21, 1.6.2.15.1, 1.6.2.16.1, 1.8.1.2, 1.8.2.; and Business Edition before C.3.6.2; when running in pedantic mode allows remote authenticated users to execute arbitrary code via crafted caller ID data in vectors involving the (1) SIP channel driver, (2) URIENCODE dialplan function, or (3) AGI dialplan function.

Affected products

• Debian Debian Linux: version 6.0 only
• Digium Asterisk: before c.3.6.2 (fixed in c.3.6.2); from 1.2.0, up to and including 1.2.40; from 1.4.0, before 1.4.38.1 (fixed in 1.4.38.1); from 1.4.39, before 1.4.39.1 (fixed in 1.4.39.1); from 1.6.1, before 1.6.1.21 (fixed in 1.6.1.21); from 1.6.2, before 1.6.2.15.1 (fixed in 1.6.2.15.1); …
• Digium Asterisknow: version 1.5 only
• Digium s800i Firmware: version 1.2.0 only
• Fedoraproject Fedora: version 13 only; version 14 only

Published 2011-01-20. Last modified 2026-06-16.