CVE-2016-10188: Use After Free
Use-after-free vulnerability in bitlbee-libpurple before 3.5 allows remote servers to cause a denial of service (crash) or possibly execute arbitrary code by causing a file transfer connection to expire.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/bitlbeeto a version that resolves this vulnerability.Fixed in 3.6-1.3Fixed in 3.6-1.5Fixed in 3.6-4 - Upgrade
Upgrade
ubuntu/bitlbeeto a version that resolves this vulnerability.Fixed in 3.4.2-0ubuntu1+esm1
Event History
Frequently Asked Questions
What is the severity of CVE-2016-10188?
CVE-2016-10188 has a severity rating that could lead to denial of service or potential remote code execution.
How can I fix CVE-2016-10188?
To fix CVE-2016-10188, update Bitlbee to version 3.5 or later.
What causes the CVE-2016-10188 vulnerability?
CVE-2016-10188 is caused by a use-after-free condition in the bitlbee-libpurple component during file transfer connections.
Who is affected by CVE-2016-10188?
CVE-2016-10188 affects users of Bitlbee versions prior to 3.5.
What are the potential impacts of CVE-2016-10188?
The impacts of CVE-2016-10188 include application crashes and possible arbitrary code execution.