CVE-2016-2851: Buffer Overflow
Integer overflow in proto.c in libotr before 4.1.1 on 64-bit platforms allows remote attackers to cause a denial of service (memory corruption and application crash) or execute arbitrary code via a series of large OTR messages, which triggers a heap-based buffer overflow.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2016-2851?
CVE-2016-2851 is classified as a high severity vulnerability due to the potential for denial of service and remote code execution.
How do I fix CVE-2016-2851?
To mitigate CVE-2016-2851, users should upgrade to libotr version 4.1.1 or later.
What types of systems are affected by CVE-2016-2851?
CVE-2016-2851 affects 64-bit systems running vulnerable versions of libotr, Debian GNU/Linux 7.0 and 8.0, and openSUSE 42.1 and 13.2.
What kind of attack does CVE-2016-2851 enable?
CVE-2016-2851 allows remote attackers to perform denial of service attacks or execute arbitrary code through crafted OTR messages.
Is CVE-2016-2851 a buffer overflow vulnerability?
Yes, CVE-2016-2851 is a heap-based buffer overflow vulnerability triggered by large OTR messages.