Use-after-free vulnerability in the create_smp_dialog function in gtk-dialog.c in the Off-the-Record Messaging (OTR) pidgin-otr plugin before 4.0.2 for Pidgin allows remote attackers to execute arbitrary code via vectors related to the "Authenticate buddy" menu item.
CVSS Details
- CVSS 3.1 Base Score: 9.8
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | alpine-linux-upgrade-pidgin-otr | Aug 30, 2017 | Apr 11, 2016 |
| Debian | debian-upgrade-pidgin-otr | Mar 28, 2016 | Mar 23, 2016 | |
| Freebsd | freebsd-upgrade-package-pidgin-otr | Dec 10, 2025 | Mar 10, 2016 | |
| Gentoo Linux | gentoo-linux-upgrade-net-libs-libotrgentoo-linux-upgrade-x11-plugins-pidgin-otr | Oct 30, 2017 | Apr 11, 2016 | |
| Oracle Solaris | oracle-solaris-11-4-upgrade-entire-11-4-11-4-0-0-1-15-0 | Oct 19, 2018 | Apr 11, 2016 | |
| Suse | — | suse-upgrade-pidgin-otrsuse-upgrade-pidgin-plugin-otrsuse-upgrade-pidgin-plugin-otr-lang | Mar 30, 2016 | Mar 30, 2016 |
| Ubuntu | ubuntu-upgrade-pidgin-otr | Nov 19, 2024 | Apr 12, 2016 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub