Lucene search

K
gentooGentoo FoundationGLSA-201701-10
HistoryJan 02, 2017 - 12:00 a.m.

libotr, Pidgin OTR: Remote execution of arbitrary code

2017-01-0200:00:00
Gentoo Foundation
security.gentoo.org
37

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

10 High

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:N/C:C/I:C/A:C

0.096 Low

EPSS

Percentile

94.6%

Background

Pidgin Off-the-Record (OTR) messaging allows you to have private conversations over instant messaging. libotr is a portable off-the-record messaging library.

Description

Multiple vulnerabilities exist in both libotr and Pidgin OTR. Please review the CVE identifiers for more information.

Impact

A remote attacker could send a specially crafted message, possibly resulting in the execution of arbitrary code with the privileges of the process, or cause a Denial of Service condition.

Workaround

There is no known workaround at this time.

Resolution

All libotr users should upgrade to the latest version:

 # emerge --sync
 # emerge --ask --oneshot --verbose ">=net-libs/libotr-4.1.1"

All Pidgin OTR users should upgrade to the latest version:

 # emerge --sync
 # emerge --ask --oneshot --verbose ">=x11-plugins/pidgin-otr-4.0.2"
OSVersionArchitecturePackageVersionFilename
Gentooanyallnet-libs/libotr< 4.1.1UNKNOWN
Gentooanyallx11-plugins/pidgin-otr< 4.0.2UNKNOWN

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

10 High

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:N/C:C/I:C/A:C

0.096 Low

EPSS

Percentile

94.6%