CVE-2012-2369 Format string vulnerability in the log_message_cb function in otr-plugin.c in the Off-the-Record Messaging (OTR) pidgin-otr plugin before 3.2.1 for Pidgin might allow remote attackers to execute arbit...
HighCVSS 7.5
EPSS 3.5%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Format string vulnerability in the log_message_cb function in otr-plugin.c in the Off-the-Record Messaging (OTR) pidgin-otr plugin before 3.2.1 for Pidgin might allow remote attackers to execute arbitrary code via format string specifiers in data that generates a log message.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/pidgin-otr(Debian:12) | < 3.2.1-1 | 3.2.1-1 |
| debian/pidgin-otr(Debian:13) | < 3.2.1-1 | 3.2.1-1 |
| cypherpunks pidgin-otr | <= 3.2.0 | No fix listed |
References
- Debian Security Tracker CVE-2012-2369 vendor-advisory
- SUSE-SU-2012:0703 vendor-advisory
- [oss-security] 20120516 Format string security flaw in pidgin-otr mailing-list patch
- GLSA-201207-05 vendor-advisory
- DSA-2476 vendor-advisory
- bugs.debian.org issue-tracking