Integer overflow in proto.c in libotr before 4.1.1 on 64-bit platforms allows remote attackers to cause a denial of service (memory corruption and application crash) or execute arbitrary code via a series of large OTR messages, which triggers a heap-based buffer overflow.
CVSS Details
- CVSS 3.1 Base Score: 9.8
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade libotr. | Aug 30, 2017 | Apr 7, 2016 |
| Debian | — | Upgrade libotr | Apr 7, 2016 | Mar 9, 2016 |
| Freebsd | — | Upgrade libotr3Upgrade libotr | Dec 10, 2025 | Mar 9, 2016 |
| Gentoo Linux | — | Upgrade x11-plugins/pidgin-otr.Upgrade net-libs/libotr. | Oct 30, 2017 | Apr 7, 2016 |
| Oracle Solaris | — | Upgrade entire/ to version 11.4-11.4.0.0.1.15.0 on Solaris 11.4 | Oct 19, 2018 | Apr 7, 2016 |
| Suse | — | Upgrade libotr-develUpgrade libotr2Upgrade libotr5 | Mar 9, 2016 | Mar 9, 2016 |
| Ubuntu | — | Upgrade libotr2 | Apr 7, 2016 | Mar 10, 2016 |
Prioritize with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub