UBUNTU-CVE-2016-10188: Use After Free
Use-after-free vulnerability in bitlbee-libpurple before 3.5 allows remote servers to cause a denial of service (crash) or possibly execute arbitrary code by causing a file transfer connection to expire.
Affected Software
Event History
Frequently Asked Questions
What must an attacker control to exploit this issue?
An attacker needs to operate or control a remote server involved in a BitlBee/libpurple file transfer. They can trigger the flaw by causing the file transfer connection to expire.
Are unauthenticated remote attacks possible?
Yes. The CVSS vector indicates network reachability, low attack complexity, no privileges required, and no user interaction required. Successful exploitation can crash the service and may allow arbitrary code execution.
Which versions are known to be affected?
The affected component is bitlbee-libpurple before version 3.5. The provided data does not identify specific Ubuntu package versions or fixed package releases.