bitlbee - Incomplete Fix for Null Pointer Dereference Vulnerability
Summary
DLA-832-1: bitlbee - security update. Affects bitlbee versions < 3.0.5-1.2+deb7u1. Fixed in 3.0.5-1.2+deb7u1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
bitlbee is a chat gateway that allows users to connect to various instant messaging protocols through a single interface. It acts as a bridge between the user's IRC client and other chat networks such as AIM, ICQ, and MSN. This vulnerability affects bitlbee version 3.0.5-1.2+deb7u1 on Debian 7 Wheezy.
Vulnerability Detail
The vulnerability, identified as CVE-2017-5668, is an incomplete fix for a previously reported issue (CVE-2016-10189) related to a null pointer dereference when handling file transfer requests from unknown contacts. This vulnerability can be exploited by an attacker to cause a denial of service or potentially execute arbitrary code on the affected system. Additionally, CVE-2016-10188 affects bitlbee's ability to deactivate any incoming file transfer, which can be abused by malicious contacts. It is important to note that this vulnerability only affects bitlbee when used with libpurple protocols, and not other libpurple-based clients like Pidgin.
How To Fix
Minimum fixed version
3.0.5-1.2+deb7u1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade bitlbeeTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There are no specific workarounds mentioned for this vulnerability.
Conclusion
bitlbee users on Debian 7 Wheezy should update their installations to version 3.0.5-1.2+deb7u1 or later to mitigate the risk of this vulnerability. For further assistance or support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for bitlbee →
FAQ
bitlbee is a chat gateway that allows users to connect to various instant messaging protocols through a single interface.
This vulnerability affects bitlbee version 3.0.5-1.2+deb7u1 on Debian 7 Wheezy.
The vulnerability can be exploited to cause a denial of service or potentially execute arbitrary code on the affected system.
No, this vulnerability only affects bitlbee when used with libpurple protocols. Other libpurple-based clients like Pidgin are not affected.
To fix this vulnerability, it is recommended to upgrade to bitlbee version 3.0.5-1.2+deb7u1 or later.
Related vulnerabilities
Recent vulnerabilities recorded for bitlbee.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
