CPANSA-Alien-OTR-2016-2851-libotr: Alien-OTR vulnerability
Publisher | giterlizzi | Document category | csaf_security_advisory |
---|---|---|---|
Initial release date | 2016-04-07T00:00:00 | Engine | CSAF Perl Toolkit 0.25 |
Current release date | 2016-04-07T00:00:00 | Build Date | |
Current version | 1 | Status | final |
CVSS v3.1 Base Score | 9.8 | Severity | Critical |
Original language | Language | en | |
Also referred to |
Vulnerability Description
Integer overflow in proto.c in libotr before 4.1.1 on 64-bit platforms allows remote attackers to cause a denial of service (memory corruption and application crash) or execute arbitrary code via a series of large OTR messages, which triggers a heap-based buffer overflow.
Vulnerabilities
CVE-2016-2851
Vulnerability DescriptionInteger overflow in proto.c in libotr before 4.1.1 on 64-bit platforms allows remote attackers to cause a denial of service (memory corruption and application crash) or execute arbitrary code via a series of large OTR messages, which triggers a heap-based buffer overflow.
Weakness | CWE-119 : Improper Restriction of Operations within the Bounds of a Memory Buffer |
---|
Product status
Known affected
Product | Score | ||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|
Alien-OTR equal =4.1.0.0 |
|
giterlizzi
Namespace: https://github.com/giterlizzi/
gdt@cpan.org
References
- CPANSA-Alien-OTR-2016-2851-libotr JSON self
https://raw.githubusercontent.com/giterlizzi/perl-CPANSA-CSAF/develop/csaf/white/2016/cpansa-alien-otr-2016-2851-libotr.json - https://www.x41-dsec.de/lab/advisories/x41-2016-001-libotr/ external
https://www.x41-dsec.de/lab/advisories/x41-2016-001-libotr/ - http://www.debian.org/security/2016/dsa-3512 external
http://www.debian.org/security/2016/dsa-3512 - http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00021.html external
http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00021.html - https://lists.cypherpunks.ca/pipermail/otr-users/2016-March/002581.html external
https://lists.cypherpunks.ca/pipermail/otr-users/2016-March/002581.html - http://seclists.org/fulldisclosure/2016/Mar/21 external
http://seclists.org/fulldisclosure/2016/Mar/21 - http://www.securityfocus.com/bid/84285 external
http://www.securityfocus.com/bid/84285 - http://www.ubuntu.com/usn/USN-2926-1 external
http://www.ubuntu.com/usn/USN-2926-1 - http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00030.html external
http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00030.html - https://security.gentoo.org/glsa/201701-10 external
https://security.gentoo.org/glsa/201701-10 - https://www.exploit-db.com/exploits/39550/ external
https://www.exploit-db.com/exploits/39550/ - http://www.securityfocus.com/archive/1/537745/100/0/threaded external
http://www.securityfocus.com/archive/1/537745/100/0/threaded - CVE-2016-2851 (NVD) external
https://nvd.nist.gov/vuln/detail/CVE-2016-2851
Revision history
Version | Date of the revision | Summary of the revision |
---|---|---|
1 | Thu Apr 7 00:00:00 2016 | First release |
Sharing rules
TLP:WHITE
For the TLP version see: https://www.first.org/tlp/