Ubuntu 12.04 LTS: 1541-1 Critical: libotr Heap Overflow

ubuntu

August 16, 2012

Applications using Off-the-Record messaging plugins could be madeto crash or run programs if it received specially crafted networkmessages.

Summary

Applications using Off-the-Record messaging plugins could be made

to crash or run programs if it received specially crafted network

messages.

Software Description:

- libotr: Off-the-Record Messaging library

Details:

Justin Ferguson discovered multiple heap overflows in libotr. A remote

attacker could use this to craft a malformed OTR message that could

cause a denial of service via application crash or possibly execute

arbitrary code.

Topics Covered

security advisory critical Ubuntu heap overflow libotr

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 12.04 LTS:
  libotr2                         3.2.0-4ubuntu0.1

Ubuntu 11.10:
  libotr2                         3.2.0-2.1ubuntu0.1

Ubuntu 11.04:
  libotr2                         3.2.0-2ubuntu1.1

Ubuntu 10.04 LTS:
  libotr2                         3.2.0-2ubuntu0.1

After a standard system update you need to restart any instant
messaging applications using an Off-the-Record messaging plugin to
make all the necessary changes.