CVE-2017-5668

Critical

Published: 14/03/2017(UTC)Translated: 14/06/2026(UTC)NVD NIST

Summary

Bitlbee-libpurple before version 3.5.1 allows remote attackers to cause a denial of service (NULL pointer dereference and crash) and possibly execute arbitrary code via a file transfer request for a contact that is not in the contact list.

Risk Assessment

This vulnerability may lead to system crashes and allow attackers to execute unauthorized code, posing a serious security threat to the organization.

Recommendation

It is recommended to upgrade to version 3.5.1 or later to mitigate this vulnerability and ensure system security.

Other vulnerabilities in bitlbee-libpurple

CVE-2016-10188Critical
A use-after-free vulnerability in bitlbee-libpurple before version 3.5 allows remote servers to cause a denial of service (crash) or possibly execute arbitrary code by causing a file transfer connection to expire.

Original NVD description (English source)

bitlbee-libpurple before 3.5.1 allows remote attackers to cause a denial of service (NULL pointer dereference and crash) and possibly execute arbitrary code via a file transfer request for a contact that is not in the contact list. NOTE: this vulnerability exists because of an incomplete fix for CVE-2016-10189.