CVE-2011-1147: Digium Asterisk

Medium severity, CVSS 6.8. EPSS: 3.5% chance of exploitation in the next 30 days.

Multiple stack-based and heap-based buffer overflows in the (1) decode_open_type and (2) udptl_rx_packet functions in main/udptl.c in Asterisk Open Source 1.4.x before 1.4.39.2, 1.6.1.x before 1.6.1.22, 1.6.2.x before 1.6.2.16.2, and 1.8 before 1.8.2.4; Business Edition C.x.x before C.3.6.3; AsteriskNOW 1.5; and s800i (Asterisk Appliance), when T.38 support is enabled, allow remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted UDPTL packet.

Affected products

• Digium Asterisk: version 1.4.0 only; version 1.4.1 only; version 1.4.2 only; version 1.4.3 only; version 1.4.10 only; version 1.4.10.1 only; …
• Digium Asterisknow: version 1.5 only
• Digium s800i: any version

Published 2011-03-15. Last modified 2026-06-16.