PT-2016-4039 · Otr+4 · Pidgin-Otr+4

Hanno Böck · Published 2016-03-10 · Updated 2024-06-15 · CVE-2015-8833

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Pidgin versions prior to 4.0.2

Description The issue is related to a use-after-free vulnerability in the create smp dialog function in gtk-dialog.c in the Off-the-Record Messaging (OTR) pidgin-otr plugin. This vulnerability allows remote attackers to execute arbitrary code via vectors related to the "Authenticate buddy" menu item.

Recommendations For versions prior to 4.0.2, update to version 4.0.2 or later to resolve the issue. As a temporary workaround, consider disabling the create smp dialog function until a patch is available. Restrict access to the "Authenticate buddy" menu item to minimize the risk of exploitation.

Fix

Related Identifiers

ALT-PU-2016-1203

CVE-2015-8833

DSA-3528-1

MGASA-2016-0125

OPENSUSE-SU-2024:10258-1

OPENSUSE-SU-2024:11173-1

SUSE-SU-2016:0912-1

SUSE-SU-2016_0912-1

Affected Products

Alt Linux

Pidgin

Suse

Gtk-Dialog.C

Pidgin-Otr

References · 40

• https://osv.dev/vulnerability/SUSE-SU-2016:0912-1 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2015-8833 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2015-8833 · Vendor Advisory
• https://errata.altlinux.org/ALT-PU-2016-1203 · Vendor Advisory
• http://debian.org/security/2016/dsa-3528 · Vendor Advisory
• https://security-tracker.debian.org/tracker/source-package/pidgin-otr · Vendor Advisory
• http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00095.html · Vendor Advisory
• https://ubuntu.com/security/CVE-2015-8833 · Vendor Advisory
• https://security.gentoo.org/glsa/201701-10 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2015-8833 · Security Note
• http://lists.opensuse.org/opensuse-updates/2016-03/msg00109.html · Vendor Advisory
• https://osv.dev/vulnerability/DSA-3528-1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2015-8833 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-8833 · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2024:10258-1 · Vendor Advisory