Summary
It was discovered that BitlBee incorrectly handled file transfer
connections that expired when built with libpurple. A remote attacker could
possibly use this issue to cause BitlBee to crash, resulting in a denial of
service, or possibly execute arbitrary code. (CVE-2016-10188)
It was discovered that BitlBee incorrectly handled file transfer requests
for contacts that were not in the contact list. A remote attacker could
possibly use this issue to cause BitlBee to crash, resulting in a denial of
service, or possibly execute arbitrary code. (CVE-2016-10189)
Fixed packages 1
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · Pro 16.04 LTS Pro:16.04:LTS | bitlbee | 3.4.2-0ubuntu1+esm1 |
Vulnerabilities 2
-
Unscored —
Use-after-free vulnerability in bitlbee-libpurple before 3.5 allows remote servers to cause a denial of service (crash)…
-
Unscored —
BitlBee before 3.5 allows remote attackers to cause a denial of service (NULL pointer dereference and crash) and possib…