Asterisk being at the top of vuln lists isn't just because of starting with the letter 'A'. They still have the NIH syndrom and don't have a good regression testing policy. Even if a patch is provided to them for an issue it's like pulling teeth to get them to apply it. How I wish I could switch to freeswitch, but their bundled libs really irk me (moreso then Asterisk problems...). Have fun with FS though :D