—–BEGIN PGP SIGNED MESSAGE—–
Hash: SHA512
– ————————————————————————-
Debian Security Advisory DSA-3512-1 security@debian.org
https://www.debian.org/security/ Salvatore Bonaccorso
March 09, 2016 https://www.debian.org/security/faq
– ————————————————————————-
Package : libotr
CVE ID : CVE-2016-2851
Markus Vervier of X41 D-Sec GmbH discovered an integer overflow
vulnerability in libotr, an off-the-record (OTR) messaging library, in
the way how the sizes of portions of incoming messages were stored. A
remote attacker can exploit this flaw by sending crafted messages to an
application that is using libotr to perform denial of service attacks
(application crash), or potentially, execute arbitrary code with the
privileges of the user running the application.
For the oldstable distribution (wheezy), this problem has been fixed
in version 3.2.1-1+deb7u2.
For the stable distribution (jessie), this problem has been fixed in
version 4.1.0-2+deb8u1.
We recommend that you upgrade your libotr packages.
Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://www.debian.org/security/
Mailing list: debian-security-announce@lists.debian.org
—–BEGIN PGP SIGNATURE—–
Version: GnuPG v1
iQIcBAEBCgAGBQJW4JSgAAoJEAVMuPMTQ89E1+QQAIAuZqKDnJ+QjSJVtbyulSBg
pMvY1kPL2w7vQvz0uIQeIOdgsPSWEbXF/f0MZz4Q9pgSvX+vNfJQl0xn3d1avRjr
88hykJnIECpSMF5BajK7sMNBjE+SzUmEVCOoALFnUQ31ocCXAaIqKr3GOWUb3gS8
e4LoylgpujsBECoIS4SgNEPM2zqbBDR+we1BCe83iwKJ6e8Rd1/cEOPQnNlA9zSD
q9SMkc3FxVOQahIIbO8YrNeAUgExeZZG60NGMgyJwnnbRUwNkWfnaxfQJOdTNPAu
TLPA9nSvKOxw/zDQv1NCZGGib9qUd1pqWnlgfj+FUQhGOq+SOqp7svh/W6FzJMKT
pQBbbU6Sbqb1Oyksqyk7RkgWlsGXMsXLAZDZnxP+p110UFs7plU5eWNx3H6546E4
QK08SQtZv/OIpptTWQgjjCsi3van4FYVSH096FG0D6LbR0OzrWXJo70P882qH83h
I6IzPt1CVP2XUxawJ1V6glSnDY/o6AdMOzitfnyuJrDELrZo8k27ghn8CFVTjsDM
Q9BVqH5O4VB0iMMF31slYEXL/NKetkIb01WocEAVX8WViPBH1fVF7mLHlJJ/1Pvl
ESoy0zSY4x1yNMvpTj+xQf7aE1CmZPc0B5AubaLBWCK7r26M+x+7MzgyI7Mju9SE
u2YENxuNfbduwrhf5own
=yNlh
—–END PGP SIGNATURE—–
