{"id":"CVE-2016-2851","aliases":["DEBIAN-CVE-2016-2851","DSA-3512-1","EUVD-2016-3924","GHSA-p3jg-fm9x-hc9c","MGASA-2016-0117","SUSE-SU-2016:0706-1","SUSE-SU-2016:0707-1","UBUNTU-CVE-2016-2851","openSUSE-SU-2024:10546-1"],"status":"published","title":"Integer overflow in proto.c in libotr before 4.1.1 on 64-bit platforms allows remote attackers to...","description":"Integer overflow in proto.c in libotr before 4.1.1 on 64-bit platforms allows remote attackers to cause a denial of service (memory corruption and application crash) or execute arbitrary code via a series of large OTR messages, which triggers a heap-based buffer overflow.","severity":{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.24283,"percentile":0.97876,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":true},"cwes":["CWE-119"],"published":"2016-03-09T00:00:00Z","modified":"2026-09-22T07:01:58Z","exploits":[{"source":"exploitdb","id":"EDB-39550","title":"libotr 4.1.0 - Memory Corruption","type":"dos","platform":"multiple","date":"2016-03-10","url":"https://www.exploit-db.com/exploits/39550"}],"fixes":[{"ecosystem":"Debian:12","package":"libotr","fixed_in":["4.1.1-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"libotr","fixed_in":["4.1.1-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"libotr","fixed_in":["4.1.1-1"],"sources":["osv"]},{"ecosystem":"Debian:7","package":"libotr","fixed_in":["3.2.1-1+deb7u2"],"sources":["osv"]},{"ecosystem":"Debian:8","package":"libotr","fixed_in":["4.1.0-2+deb8u1"],"sources":["osv"]},{"ecosystem":"Mageia:5","package":"libotr","fixed_in":["4.1.1-1.mga5"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Software Development Kit 11 SP4","package":"libotr","fixed_in":["3.2.0-10.5.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Desktop 11 SP4","package":"libotr","fixed_in":["3.2.0-10.5.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 11 SP4","package":"libotr","fixed_in":["3.2.0-10.5.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 11 SP4","package":"libotr","fixed_in":["3.2.0-10.5.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Desktop 12","package":"libotr","fixed_in":["4.0.0-9.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Desktop 12 SP1","package":"libotr","fixed_in":["4.0.0-9.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Software Development Kit 12","package":"libotr","fixed_in":["4.0.0-9.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP1","package":"libotr","fixed_in":["4.0.0-9.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12","package":"libotr","fixed_in":["4.0.0-9.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12","package":"libotr","fixed_in":["4.0.0-9.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12 SP1","package":"libotr","fixed_in":["4.0.0-9.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP1","package":"libotr","fixed_in":["4.0.0-9.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:14.04:LTS","package":"libotr","fixed_in":["4.0.0-2.2ubuntu1.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"libotr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.1-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"libotr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.1-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"libotr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.1-1"}]}]},{"source":"osv","ecosystem":"Debian:7","package":"libotr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.1-1+deb7u2"}]}],"versions":["3.2.1-1","3.2.1-1+deb7u1"]},{"source":"osv","ecosystem":"Debian:8","package":"libotr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.0-2+deb8u1"}]}],"versions":["4.1.0-2","4.1.0-2+deb8u1~bpo70+1"]},{"source":"osv","ecosystem":"Mageia:5","package":"libotr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.1-1.mga5"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 11 SP4","package":"libotr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.0-10.5.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 11 SP4","package":"libotr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.0-10.5.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP4","package":"libotr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.0-10.5.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 11 SP4","package":"libotr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.0-10.5.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12","package":"libotr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.0-9.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12 SP1","package":"libotr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.0-9.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12","package":"libotr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.0-9.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP1","package":"libotr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.0-9.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12","package":"libotr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.0-9.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12","package":"libotr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.0-9.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP1","package":"libotr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.0-9.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP1","package":"libotr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.0-9.1"}]}]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"libotr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.0-2.2ubuntu1.1"}]}],"versions":["4.0.0-2.2","4.0.0-2.2ubuntu1"]}],"products":[{"vendor":"cypherpunks","product":"libotr"},{"vendor":"debian","product":"debian_linux"},{"vendor":"opensuse","product":"leap"},{"vendor":"opensuse","product":"opensuse"}],"references":[{"url":"http://www.ubuntu.com/usn/USN-2926-1","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred","Third Party Advisory","advisory"]},{"url":"http://www.securityfocus.com/archive/1/537745/100/0/threaded","tags":["mailing-list","x_refsource_BUGTRAQ","x_transferred","Third Party Advisory","advisory"]},{"url":"http://www.debian.org/security/2016/dsa-3512","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","Third Party Advisory","advisory"]},{"url":"https://security.gentoo.org/glsa/201701-10","tags":["vendor-advisory","x_refsource_GENTOO","x_transferred","Third Party Advisory","advisory"]},{"url":"https://www.exploit-db.com/exploits/39550/","tags":["exploit","x_refsource_EXPLOIT-DB","x_transferred","Third Party Advisory","VDB Entry","advisory"]},{"url":"http://www.securityfocus.com/bid/84285","tags":["vdb-entry","x_refsource_BID","x_transferred","Third Party Advisory","VDB Entry","advisory"]},{"url":"http://seclists.org/fulldisclosure/2016/Mar/21","tags":["mailing-list","x_refsource_FULLDISC","x_transferred","Exploit","Mailing List","Third Party Advisory","evidence"]},{"url":"https://www.x41-dsec.de/lab/advisories/x41-2016-001-libotr/","tags":["x_refsource_MISC","x_transferred","Exploit","evidence","advisory","report"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00021.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","Mailing List","article"]},{"url":"https://lists.cypherpunks.ca/pipermail/otr-users/2016-March/002581.html","tags":["mailing-list","x_refsource_MLIST","x_transferred","Exploit","evidence","report"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00030.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","Vendor Advisory","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-2851"},{"url":"https://www.exploit-db.com/exploits/39550"},{"url":"https://www.x41-dsec.de/lab/advisories/x41-2016-001-libotr"},{"url":"https://github.com/advisories/GHSA-p3jg-fm9x-hc9c"},{"url":"https://security-tracker.debian.org/tracker/CVE-2016-2851","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2016-0117.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=17927","tags":["report"]},{"url":"https://www.suse.com/support/update/announcement/2016/suse-su-20160706-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/969785","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2016-2851","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2016/suse-su-20160707-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2016-2851","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-2926-1","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-2851","tags":["report"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2016-2851","description":"Integer overflow in proto.c in libotr before 4.1.1 on 64-bit platforms allows remote attackers to cause a denial of service (memory corruption and application crash) or execute arbitrary code via a series of large OTR messages, which triggers a heap-based buffer overflow.","status":"published","published":"2016-04-07T23:00:00Z","modified":"2024-08-05T23:32:21.378Z","updated_at":"2026-11-02T14:33:33.07583Z"}],"euvd":[{"id":"EUVD-2016-3924","description":"Integer overflow in proto.c in libotr before 4.1.1 on 64-bit platforms allows remote attackers to cause a denial of service (memory corruption and application crash) or execute arbitrary code via a series of large OTR messages, which triggers a heap-based buffer overflow.","status":"published","published":"2016-04-07T23:00:00Z","modified":"2024-08-05T23:32:21Z","updated_at":"2026-11-03T02:22:52.199729Z"}],"ghsa":[{"id":"GHSA-p3jg-fm9x-hc9c","title":"Integer overflow in proto.c in libotr before 4.1.1 on 64-bit platforms allows remote attackers to...","description":"Integer overflow in proto.c in libotr before 4.1.1 on 64-bit platforms allows remote attackers to cause a denial of service (memory corruption and application crash) or execute arbitrary code via a series of large OTR messages, which triggers a heap-based buffer overflow.","status":"published","published":"2022-05-14T02:08:47Z","modified":"2025-04-12T12:59:15Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-119"],"updated_at":"2026-11-02T15:01:26.389958Z"}],"nvd":[{"id":"CVE-2016-2851","description":"Integer overflow in proto.c in libotr before 4.1.1 on 64-bit platforms allows remote attackers to cause a denial of service (memory corruption and application crash) or execute arbitrary code via a series of large OTR messages, which triggers a heap-based buffer overflow.","status":"published","published":"2016-04-07T23:59:09.94Z","modified":"2026-06-17T00:44:35.597Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"},{"version":"2.0","score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","level":"high","assessor":"primary"}],"cwes":["CWE-119"],"updated_at":"2026-11-02T14:03:22.479119Z"}],"osv":[{"id":"CVE-2016-2851","description":"Integer overflow in proto.c in libotr before 4.1.1 on 64-bit platforms allows remote attackers to cause a denial of service (memory corruption and application crash) or execute arbitrary code via a series of large OTR messages, which triggers a heap-based buffer overflow.","status":"published","published":"2016-04-07T23:59:09.94Z","modified":"2026-04-16T06:22:07.471582059Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:44:02.114472Z"},{"id":"DEBIAN-CVE-2016-2851","description":"Integer overflow in proto.c in libotr before 4.1.1 on 64-bit platforms allows remote attackers to cause a denial of service (memory corruption and application crash) or execute arbitrary code via a series of large OTR messages, which triggers a heap-based buffer overflow.","status":"published","published":"2016-04-07T23:59:09.94Z","modified":"2026-09-22T07:01:58.626290091Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:45:27.627285Z"},{"id":"UBUNTU-CVE-2016-2851","description":"Integer overflow in proto.c in libotr before 4.1.1 on 64-bit platforms allows remote attackers to cause a denial of service (memory corruption and application crash) or execute arbitrary code via a series of large OTR messages, which triggers a heap-based buffer overflow.","status":"published","published":"2016-03-09T00:00:00Z","modified":"2026-04-22T10:40:09.00894Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:54:11.872222Z"},{"id":"DSA-3512-1","title":"libotr - security update","status":"published","published":"2016-03-09T00:00:00Z","modified":"2026-03-09T02:08:36.692977Z","updated_at":"2026-11-02T15:46:16.199525Z"},{"id":"MGASA-2016-0117","title":"Updated libotr packages fix security vulnerability","description":"A remote attacker may crash or execute arbitrary code in libotr before\n4.1.1 by sending large OTR messages. While processing specially crafted\nmessages, attacker controlled data on the heap is written out of bounds\n(CVE-2016-2851).\n","status":"published","published":"2016-03-25T06:38:37Z","modified":"2026-04-16T06:25:03.617404331Z","updated_at":"2026-11-02T15:49:39.792687Z"},{"id":"openSUSE-SU-2024:10546-1","title":"libotr-devel-4.1.1-1.6 on GA media","description":"These are all security issues fixed in the libotr-devel-4.1.1-1.6 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2025-05-07T18:09:19.336358Z","updated_at":"2026-11-02T16:58:34.487567Z"},{"id":"SUSE-SU-2016:0706-1","title":"Security update for libotr","description":"\nThis update for libotr fixes the following issues:\n\n- Apply 'libotr-CVE-2016-2851.patch' to fix integer overflows that\n  used to occur on 64-bit architectures when receiving 4GB messages.\n  This flaw could potentially have been exploited by an attacker to\n  remotely execute arbitrary code on the user's machine.\n  (CVE-2016-2851, bsc#969785)\n","status":"published","published":"2016-03-09T18:06:39Z","modified":"2026-02-04T03:02:53.26332Z","updated_at":"2026-11-02T15:53:43.030986Z"},{"id":"SUSE-SU-2016:0707-1","title":"Security update for libotr","description":"\nThis update for libotr fixes the following issue:\n\n- Apply 'libotr-CVE-2016-2851.patch' to fix integer overflows that\n  used to occur on 64-bit architectures when receiving 4GB messages.\n  This flaw could potentially have been exploited by an attacker to\n  remotely execute arbitrary code on the user's machine\n  * (CVE-2016-2851, bsc#969785)\n","status":"published","published":"2016-03-09T18:01:45Z","modified":"2026-02-04T04:00:26.073347Z","updated_at":"2026-11-02T15:53:43.030986Z"}]}}