Gentoo Linux Security Advisory 201701-10 - Multiple vulnerabilities have been found in libotr and Pidgin OTR, allowing remote attackers to execute arbitrary code. Versions less than 4.1.1 are affected.
d13bfedbb70f7760cf106edf31ad9f23912553d80d14d052eb493a387df6dacfDebian Linux Security Advisory 3512-1 - Markus Vervier of X41 D-Sec GmbH discovered an integer overflow vulnerability in libotr, an off-the-record (OTR) messaging library, in the way how the sizes of portions of incoming messages were stored. A remote attacker can exploit this flaw by sending crafted messages to an application that is using libotr to perform denial of service attacks (application crash), or potentially, execute arbitrary code with the privileges of the user running the application.
594fab421417edb38ff98ef311a8b0ebff4444c304515883af5077c0246f3a6bA remote attacker may crash or execute arbitrary code in libotr by sending large OTR messages. While processing specially crafted messages, attacker controlled data on the heap is written out of bounds. No special user interaction or authorization is necessary in default configurations. libotr versions 4.1.0 and below are affected.
ea7da15f0bdfd219e45644306a8022ee070808fe6f08855862fdfa8bf03c3509Ubuntu Security Notice 2926-1 - Markus Vervier discovered that OTR incorrectly handled large incoming messages. A remote attacker could use this issue to cause OTR to crash, resulting in a denial of service, or possibly execute arbitrary code.
f67b0217d1992c373207172bb28efa3fdad04ab3e16925e3431e054bc3bc43c1
© 2022 Packet Storm. All rights reserved.
%7Cutmcsr%3D(direct)%7Cutmcmd%3D(none)){kind=small}
Follow us on Twitter
Follow us on Facebook
Subscribe to an RSS Feed