Integer overflow in proto.c in libotr before 4.1.1 on 64-bit platforms allows remote attackers to cause a denial of service (memory corruption and application crash) or execute arbitrary code via a series of large OTR messages, which triggers a heap-based buffer overflow.
CVSS Details
- CVSS 3.1 Base Score: 9.8
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade libotr. | Aug 30, 2017 | Apr 7, 2016 |
| Debian | — | Upgrade libotr | Apr 7, 2016 | Mar 9, 2016 |
| Freebsd | — | Upgrade libotrUpgrade libotr3 | Dec 10, 2025 | Mar 9, 2016 |
| Gentoo Linux | — | Upgrade net-libs/libotr.Upgrade x11-plugins/pidgin-otr. | Oct 30, 2017 | Apr 7, 2016 |
| Oracle Solaris | — | Upgrade entire/ to version 11.4-11.4.0.0.1.15.0 on Solaris 11.4 | Oct 19, 2018 | Apr 7, 2016 |
| Suse | — | Upgrade libotr2Upgrade libotr-develUpgrade libotr5 | Mar 9, 2016 | Mar 9, 2016 |
| Ubuntu | — | Upgrade libotr2 | Apr 7, 2016 | Mar 10, 2016 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub