Candidate: CVE-2015-8833
PublicDate: 2016-04-12 01:59:00 UTC
References:
 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-8833
 https://blog.fuzzing-project.org/39-Heap-use-after-free-in-Pidgin-OTR-plugin.html
 https://bugs.otr.im/issues/88
 https://bugs.otr.im/issues/128
 https://bugs.otr.im/projects/pidgin-otr/repository/revisions/aaf551b9dd5cbba8c4abaa3d4dc7ead860efef94
 http://www.openwall.com/lists/oss-security/2016/03/09/8
Description:
 Use-after-free vulnerability in the create_smp_dialog function in
 gtk-dialog.c in the Off-the-Record Messaging (OTR) pidgin-otr plugin before
 4.0.2 for Pidgin allows remote attackers to execute arbitrary code via
 vectors related to the "Authenticate buddy" menu item.
Ubuntu-Description:
Notes:
Bugs:
Priority: medium
Discovered-by: Stefan Sperling and Hanno Böck
Assigned-to:
CVSS:
 nvd: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H [9.8 CRITICAL]

Patches_pidgin-otr:
upstream_pidgin-otr: released (4.0.2-1)
precise_pidgin-otr: ignored (reached end-of-life)
precise/esm_pidgin-otr: DNE (precise was needs-triage)
trusty_pidgin-otr: ignored (reached end-of-life)
trusty/esm_pidgin-otr: DNE (trusty was needed)
vivid/stable-phone-overlay_pidgin-otr: DNE
vivid/ubuntu-core_pidgin-otr: DNE
wily_pidgin-otr: released (4.0.1-1+deb8u1build0.15.10.1)
xenial_pidgin-otr: not-affected (4.0.2-1)
yakkety_pidgin-otr: not-affected (4.0.2-1)
zesty_pidgin-otr: not-affected (4.0.2-1)
artful_pidgin-otr: not-affected (4.0.2-1)
bionic_pidgin-otr: not-affected (4.0.2-1)
cosmic_pidgin-otr: not-affected (4.0.2-1)
disco_pidgin-otr: not-affected (4.0.2-1)
devel_pidgin-otr: not-affected (4.0.2-1)