debian/bitlbee vulnerabilities

Latest debian/bitlbee CVEs

Newest publication first

1. CVE-2012-1187 Bitlbee does not drop extra group privileges correctly in unix.c

   Published 2019-10-29

   Critical·CVSS 9.8 EPSS 1.6%

   Bitlbee does not drop extra group privileges correctly in unix.c

2. DSA-3853-1 bitlbee - security update

   Published 2017-05-14

   Unknown

3. CVE-2017-5668 bitlbee-libpurple before 3.5.1 allows remote attackers to cause a denial of service (NULL pointer dereference and crash) and possibly execute arbitrary code via a file transfer request for a contact t...

   Published 2017-03-14

   Critical·CVSS 9.8 EPSS 3.0%

   bitlbee-libpurple before 3.5.1 allows remote attackers to cause a denial of service (NULL pointer dereference and crash) and possibly execute arbitrary code via a file transfer request for a contact that is not in the contact list. NOTE: this vulnerability exists because of an in...

4. CVE-2016-10189 BitlBee before 3.5 allows remote attackers to cause a denial of service (NULL pointer dereference and crash) and possibly execute arbitrary code via a file transfer request for a contact that is not i...

   Published 2017-03-14

   High·CVSS 7.5 EPSS 4.0%

   BitlBee before 3.5 allows remote attackers to cause a denial of service (NULL pointer dereference and crash) and possibly execute arbitrary code via a file transfer request for a contact that is not in the contact list.

5. CVE-2016-10188 Use-after-free vulnerability in bitlbee-libpurple before 3.5 allows remote servers to cause a denial of service (crash) or possibly execute arbitrary code by causing a file transfer connection to expi...

   Published 2017-03-14

   Critical·CVSS 9.8 EPSS 2.9%

   Use-after-free vulnerability in bitlbee-libpurple before 3.5 allows remote servers to cause a denial of service (crash) or possibly execute arbitrary code by causing a file transfer connection to expire.

6. DLA-832-1 bitlbee - security update

   Published 2017-02-20

   Unknown

7. CVE-2008-3969 Multiple unspecified vulnerabilities in BitlBee before 1.2.3 allow remote attackers to "overwrite" and "hijack" existing accounts via unknown vectors related to "inconsistent handling of the USTATUS_I...

   Published 2008-09-10

   Medium·CVSS 5.0 EPSS 2.4%

   Multiple unspecified vulnerabilities in BitlBee before 1.2.3 allow remote attackers to "overwrite" and "hijack" existing accounts via unknown vectors related to "inconsistent handling of the USTATUS_IDENTIFIED state." NOTE: this issue exists because of an incomplete fix for CVE-2...

8. CVE-2008-3920 Unspecified vulnerability in BitlBee before 1.2.2 allows remote attackers to "recreate" and "hijack" existing accounts via unspecified vectors.

   Published 2008-09-04

   High·CVSS 7.5 EPSS 2.1%

   Unspecified vulnerability in BitlBee before 1.2.2 allows remote attackers to "recreate" and "hijack" existing accounts via unspecified vectors.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.