CVE-2017-5668 Null dereference in n/a
Remote attackers can cause a crash or potentially execute code via a file transfer request to an unknown contact in Bitlbee.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2017-5668?
CVE-2017-5668 is a critical vulnerability in n/a, published on 14 Mar 2017. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
bitlbee-libpurple before 3.5.1 allows remote attackers to cause a denial of service (NULL pointer dereference and crash) and possibly execute arbitrary code via a file transfer request for a contact that is not in the contact list. NOTE: this vulnerability exists because of an incomplete fix for CVE-2016-10189.
Weakness: CWE-476
Which versions are affected by CVE-2017-5668?
It affects 2 products.
Products include Bitlbee Bitlbee, Bitlbee Bitlbee-Libpurple.
How do I fix CVE-2017-5668?
Upgrade to a fixed version.
Is CVE-2017-5668 being exploited?
There is no known exploitation of CVE-2017-5668 in the wild and no public exploit code.
Other vulnerabilities in n/a
- CVE-2012-1187 Privilege escalation in Bitlbee
- CVE-2016-10188 Use after free in n/a
- CVE-2016-10189 Null dereference in n/a
- CVE-2008-3920 Unspecified vulnerability in BitlBee before 1.2.2 allows remote attackers to "recreate" and "hijack" existing accounts via unspecified vectors.
- CVE-2008-3969 Multiple unspecified vulnerabilities in BitlBee before 1.2.3 allow remote attackers to "overwrite" and "hijack" existing accounts via unknow
Sources
Also known as DEBIAN-CVE-2017-5668, GHSA-x9m7-9m6q-c6hr, UBUNTU-CVE-2017-5668.