CVE-2017-5668

bitlbee-libpurple before 3.5.1 allows remote attackers to cause a denial of
service (NULL pointer dereference and crash) and possibly execute arbitrary
code via a file transfer request for a contact that is not in the contact
list. NOTE: this vulnerability exists because of an incomplete fix for
CVE-2016-10189.

Bugs

• <http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=853282&gt;