CVE-2016-10189: Null Pointer Dereference
BitlBee before 3.5 allows remote attackers to cause a denial of service (NULL pointer dereference and crash) and possibly execute arbitrary code via a file transfer request for a contact that is not in the contact list.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/bitlbeeto a version that resolves this vulnerability.Fixed in 3.6-1.3Fixed in 3.6-1.5Fixed in 3.6-4
Event History
Frequently Asked Questions
What is the severity of CVE-2016-10189?
CVE-2016-10189 has a medium severity level due to the potential for denial of service and arbitrary code execution.
How do I fix CVE-2016-10189?
To fix CVE-2016-10189, upgrade to BitlBee version 3.5 or later.
What types of attacks can CVE-2016-10189 facilitate?
CVE-2016-10189 can facilitate denial of service attacks and potentially allow for arbitrary code execution.
Which versions of BitlBee are affected by CVE-2016-10189?
CVE-2016-10189 affects BitlBee versions prior to 3.5 and BitlBee-libpurple up to and including 3.4.2.
Can CVE-2016-10189 be exploited remotely?
Yes, CVE-2016-10189 can be exploited remotely through a malicious file transfer request.