PT-2016-4039 · Otr+4 · Pidgin-Otr+4

Hanno Böck · Publicado 2016-03-10 · Atualizado 2024-06-15 · CVE-2015-8833

Positive Technologies (AI Summary)

CVSS v3.1

10

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Pidgin versions prior to 4.0.2

Description The issue is related to a use-after-free vulnerability in the create smp dialog function in gtk-dialog.c in the Off-the-Record Messaging (OTR) pidgin-otr plugin. This vulnerability allows remote attackers to execute arbitrary code via vectors related to the "Authenticate buddy" menu item.

Recommendations For versions prior to 4.0.2, update to version 4.0.2 or later to resolve the issue. As a temporary workaround, consider disabling the create smp dialog function until a patch is available. Restrict access to the "Authenticate buddy" menu item to minimize the risk of exploitation.

Correção

Identificadores relacionados

ALT-PU-2016-1203

CVE-2015-8833

DSA-3528-1

MGASA-2016-0125

OPENSUSE-SU-2024:10258-1

OPENSUSE-SU-2024:11173-1

SUSE-SU-2016:0912-1

SUSE-SU-2016_0912-1

Produtos afetados

Alt Linux

Pidgin

Suse

Gtk-Dialog.C

Pidgin-Otr

Referências · 40

• https://osv.dev/vulnerability/SUSE-SU-2016:0912-1 · Aviso do Fabricante
• https://cve.org/CVERecord?id=CVE-2015-8833 · Nota de Segurança
• https://security-tracker.debian.org/tracker/CVE-2015-8833 · Aviso do Fabricante
• https://bugs.otr.im/projects/pidgin-otr/repository/revisions/aaf551b9dd5cbba8c4abaa3d4dc7ead860efef94 · Nota
• https://errata.altlinux.org/ALT-PU-2016-1203 · Aviso do Fabricante
• https://t.me/cvenotify/18615 · Publicação no Telegram
• http://debian.org/security/2016/dsa-3528 · Aviso do Fabricante
• http://securityfocus.com/bid/84295 · Nota
• https://security-tracker.debian.org/tracker/source-package/pidgin-otr · Aviso do Fabricante
• http://openwall.com/lists/oss-security/2016/03/09/13 · Nota
• https://bugs.otr.im/issues/88 · Nota
• http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00095.html · Aviso do Fabricante
• https://bugs.otr.im/issues/128 · Nota
• https://ubuntu.com/security/CVE-2015-8833 · Aviso do Fabricante
• https://suse.com/security/cve/CVE-2015-8833 · Nota