CVE-2016-2851

Опубликовано: 07 апр. 2016

Источник: nvd

CVSS3: 9.8

CVSS2: 7.5

EPSS Средний

Описание

Integer overflow in proto.c in libotr before 4.1.1 on 64-bit platforms allows remote attackers to cause a denial of service (memory corruption and application crash) or execute arbitrary code via a series of large OTR messages, which triggers a heap-based buffer overflow.

Ссылки

http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00021.html
Mailing List
http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00030.html
Vendor Advisory
http://seclists.org/fulldisclosure/2016/Mar/21
Exploit
Mailing List
Third Party Advisory
http://www.debian.org/security/2016/dsa-3512
Third Party Advisory
http://www.securityfocus.com/archive/1/537745/100/0/threaded
Third Party Advisory
http://www.securityfocus.com/bid/84285
Third Party Advisory
VDB Entry
http://www.ubuntu.com/usn/USN-2926-1
Third Party Advisory
https://lists.cypherpunks.ca/pipermail/otr-users/2016-March/002581.html
Exploit
https://security.gentoo.org/glsa/201701-10
Third Party Advisory
https://www.exploit-db.com/exploits/39550/
Third Party Advisory
VDB Entry
https://www.x41-dsec.de/lab/advisories/x41-2016-001-libotr/
Exploit
http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00021.html
Mailing List
http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00030.html
Vendor Advisory
http://seclists.org/fulldisclosure/2016/Mar/21
Exploit
Mailing List
Third Party Advisory
http://www.debian.org/security/2016/dsa-3512
Third Party Advisory
http://www.securityfocus.com/archive/1/537745/100/0/threaded
Third Party Advisory
http://www.securityfocus.com/bid/84285
Third Party Advisory
VDB Entry
http://www.ubuntu.com/usn/USN-2926-1
Third Party Advisory
https://lists.cypherpunks.ca/pipermail/otr-users/2016-March/002581.html
Exploit
https://security.gentoo.org/glsa/201701-10
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:o:debian:debian_linux:7.0:*:*:*:*:*:*:*

cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*

Конфигурация 2

Одно из

cpe:2.3:o:opensuse:leap:42.1:*:*:*:*:*:*:*

cpe:2.3:o:opensuse:opensuse:13.2:*:*:*:*:*:*:*

Конфигурация 3

cpe:2.3:a:cypherpunks:libotr:*:*:*:*:*:*:*:*

Версия до 4.1.0 (включая)

EPSS

Процентиль: 96%

0.23058

Средний

9.8 Critical

CVSS3

7.5 High

CVSS2

Дефекты

CWE-119

Связанные уязвимости

CVE-2016-2851

CVSS3: 9.8

ubuntu

почти 10 лет назад

CVE-2016-2851

CVSS3: 9.8

debian

почти 10 лет назад

Integer overflow in proto.c in libotr before 4.1.1 on 64-bit platforms ...

openSUSE-SU-2016:0708-1

suse-cvrf

почти 10 лет назад

Security update for libotr,libotr2

SUSE-SU-2016:0707-1

suse-cvrf

почти 10 лет назад

Security update for libotr

SUSE-SU-2016:0706-1

suse-cvrf

почти 10 лет назад

Security update for libotr

EPSS

Процентиль: 96%

0.23058

Средний

9.8 Critical

CVSS3

7.5 High

CVSS2

Дефекты

CWE-119