CVE-2016-2851
Integer overflow in proto.c in libotr before 4.1.1 on 64-bit platforms allows remote attackers to...
Integer overflow in proto.c in libotr before 4.1.1 on 64-bit platforms allows remote attackers to cause a denial of service (memory corruption and application crash) or execute arbitrary code via a series of large OTR messages, which triggers a heap-based buffer overflow.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
Integer overflow in proto.c in libotr before 4.1.1 on 64-bit platforms allows remote attackers to cause a denial of service (memory corruption and application crash) or execute arbitrary code via a series of large OTR messages, which triggers a heap-based buffer overflow.
- Record
CVE-2016-2851- CVSS 3.0
- 9.8 Critical
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - CVSS 2.0
- 7.5 High
AV:N/AC:L/Au:N/C:P/I:P/A:P - Weakness
- CWE-119
- Updated
- 2026-11-02
CVE List No score
Integer overflow in proto.c in libotr before 4.1.1 on 64-bit platforms allows remote attackers to cause a denial of service (memory corruption and application crash) or execute arbitrary code via a series of large OTR messages, which triggers a heap-based buffer overflow.
- Record
CVE-2016-2851- Updated
- 2026-11-02
EUVDEUVD-2016-3924 No score
Integer overflow in proto.c in libotr before 4.1.1 on 64-bit platforms allows remote attackers to cause a denial of service (memory corruption and application crash) or execute arbitrary code via a series of large OTR messages, which triggers a heap-based buffer overflow.
- Record
EUVD-2016-3924- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-p3jg-fm9x-hc9c
Integer overflow in proto.c in libotr before 4.1.1 on 64-bit platforms allows remote attackers to...
Integer overflow in proto.c in libotr before 4.1.1 on 64-bit platforms allows remote attackers to cause a denial of service (memory corruption and application crash) or execute arbitrary code via a series of large OTR messages, which triggers a heap-based buffer overflow.
- Record
GHSA-p3jg-fm9x-hc9c- CVSS 3.0
- 9.8 Critical
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-119
- Updated
- 2026-11-02
OSV
Integer overflow in proto.c in libotr before 4.1.1 on 64-bit platforms allows remote attackers to cause a denial of service (memory corruption and application crash) or execute arbitrary code via a series of large OTR messages, which triggers a heap-based buffer overflow.
- Record
CVE-2016-2851- CVSS 3.0
- 9.8 Critical
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVDEBIAN-CVE-2016-2851
Integer overflow in proto.c in libotr before 4.1.1 on 64-bit platforms allows remote attackers to cause a denial of service (memory corruption and application crash) or execute arbitrary code via a series of large OTR messages, which triggers a heap-based buffer overflow.
- Record
DEBIAN-CVE-2016-2851- CVSS 3.0
- 9.8 Critical
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
Show 5 moreShow less
OSVUBUNTU-CVE-2016-2851
Integer overflow in proto.c in libotr before 4.1.1 on 64-bit platforms allows remote attackers to cause a denial of service (memory corruption and application crash) or execute arbitrary code via a series of large OTR messages, which triggers a heap-based buffer overflow.
- Record
UBUNTU-CVE-2016-2851- CVSS 3.0
- 9.8 Critical
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVMGASA-2016-0117 No score
Updated libotr packages fix security vulnerability
A remote attacker may crash or execute arbitrary code in libotr before 4.1.1 by sending large OTR messages. While processing specially crafted messages, attacker controlled data on the heap is written out of bounds (CVE-2016-2851).
- Record
MGASA-2016-0117- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:10546-1 No score
libotr-devel-4.1.1-1.6 on GA media
These are all security issues fixed in the libotr-devel-4.1.1-1.6 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:10546-1- Updated
- 2026-11-02
OSVSUSE-SU-2016:0706-1 No score
Security update for libotr
This update for libotr fixes the following issues:
- Apply 'libotr-CVE-2016-2851.patch' to fix integer overflows that used to occur on 64-bit architectures when receiving 4GB messages. This flaw could potentially have been exploited by an attacker to remotely execute arbitrary code on the user's machine. (CVE-2016-2851, bsc#969785)
- Record
SUSE-SU-2016:0706-1- Updated
- 2026-11-02
OSVSUSE-SU-2016:0707-1 No score
Security update for libotr
This update for libotr fixes the following issue:
- Apply 'libotr-CVE-2016-2851.patch' to fix integer overflows that
used to occur on 64-bit architectures when receiving 4GB messages.
This flaw could potentially have been exploited by an attacker to
remotely execute arbitrary code on the user's machine
- (CVE-2016-2851, bsc#969785)
- Record
SUSE-SU-2016:0707-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
libotrDebian:12 |
before 4.1.1-1 | 4.1.1-1 |
libotrDebian:13 |
before 4.1.1-1 | 4.1.1-1 |
libotrDebian:14 |
before 4.1.1-1 | 4.1.1-1 |
libotrDebian:7 |
before 3.2.1-1+deb7u2, plus listed versions 3.2.1-13.2.1-1+deb7u1 |
3.2.1-1+deb7u2 |
libotrDebian:8 |
before 4.1.0-2+deb8u1, plus listed versions 4.1.0-24.1.0-2+deb8u1~bpo70+1 |
4.1.0-2+deb8u1 |
libotrMageia:5 |
before 4.1.1-1.mga5 | 4.1.1-1.mga5 |
libotrSUSE:Linux Enterprise Software Development Kit 11 SP4 |
before 3.2.0-10.5.1 | 3.2.0-10.5.1 |
libotrSUSE:Linux Enterprise Desktop 11 SP4 |
before 3.2.0-10.5.1 | 3.2.0-10.5.1 |
libotrSUSE:Linux Enterprise Server 11 SP4 |
before 3.2.0-10.5.1 | 3.2.0-10.5.1 |
libotrSUSE:Linux Enterprise Server for SAP Applications 11 SP4 |
before 3.2.0-10.5.1 | 3.2.0-10.5.1 |
Show 9 moreShow less
| Package | Affected | Fixed |
|---|---|---|
libotrSUSE:Linux Enterprise Desktop 12 |
before 4.0.0-9.1 | 4.0.0-9.1 |
libotrSUSE:Linux Enterprise Desktop 12 SP1 |
before 4.0.0-9.1 | 4.0.0-9.1 |
libotrSUSE:Linux Enterprise Software Development Kit 12 |
before 4.0.0-9.1 | 4.0.0-9.1 |
libotrSUSE:Linux Enterprise Software Development Kit 12 SP1 |
before 4.0.0-9.1 | 4.0.0-9.1 |
libotrSUSE:Linux Enterprise Server 12 |
before 4.0.0-9.1 | 4.0.0-9.1 |
libotrSUSE:Linux Enterprise Server for SAP Applications 12 |
before 4.0.0-9.1 | 4.0.0-9.1 |
libotrSUSE:Linux Enterprise Server 12 SP1 |
before 4.0.0-9.1 | 4.0.0-9.1 |
libotrSUSE:Linux Enterprise Server for SAP Applications 12 SP1 |
before 4.0.0-9.1 | 4.0.0-9.1 |
libotrUbuntu:14.04:LTS |
before 4.0.0-2.2ubuntu1.1, plus listed versions 4.0.0-2.24.0.0-2.2ubuntu1 |
4.0.0-2.2ubuntu1.1 |
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| Exploit-DB | libotr 4.1.0 - Memory Corruption | 2016-03-10 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, Exploit-DB, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2016-2851 is a critical vulnerability (CVSS 9.8) in Cypherpunks Libotr, published March 9, 2016. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 24.3%, the 97th percentile. Fixed in libotr 4.1.1-1.
References
ubuntu.com/usn/USN-2926-1
securityfocus.com/archive/1/537745/100/0/threaded
debian.org/security/2016/dsa-3512
security.gentoo.org/glsa/201701-10
exploit-db.com/exploits/39550
Show 17 moreShow less
seclists.org/fulldisclosure/2016/Mar/21
x41-dsec.de/lab/advisories/x41-2016-001-libotr
lists.opensuse.org/opensuse-security-announce/2016-03/msg00021.html
lists.cypherpunks.ca/pipermail/otr-users/2016-March/002581.html
nvd.nist.gov/vuln/detail/CVE-2016-2851
github.com/advisories/GHSA-p3jg-fm9x-hc9c
security-tracker.debian.org/tracker/CVE-2016-2851
advisories.mageia.org/MGASA-2016-0117.html
bugs.mageia.org/show_bug.cgi?id=17927
suse.com/support/update/announcement/2016/suse-su-20160706-1
bugzilla.suse.com/969785
ubuntu.com/security/CVE-2016-2851
cve.org/CVERecord?id=CVE-2016-2851