CVE-2016-2851

Integer overflow in proto.c in libotr before 4.1.1 on 64-bit platforms allows remote attackers to cause a denial of service (memory corruption and application crash) or execute arbitrary code via a series of large OTR messages, which triggers a heap-based buffer overflow.

• CWE-119

• http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00021.htmlMailing List
• http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00030.htmlVendor Advisory
• http://seclists.org/fulldisclosure/2016/Mar/21Exploit, Mailing List, Third Party Advisory
• http://www.debian.org/security/2016/dsa-3512Third Party Advisory
• http://www.securityfocus.com/archive/1/537745/100/0/threadedThird Party Advisory
• http://www.securityfocus.com/bid/84285Third Party Advisory, VDB Entry
• http://www.ubuntu.com/usn/USN-2926-1Third Party Advisory
• https://lists.cypherpunks.ca/pipermail/otr-users/2016-March/002581.htmlExploit
• https://security.gentoo.org/glsa/201701-10Third Party Advisory
• https://www.exploit-db.com/exploits/39550/Third Party Advisory, VDB Entry
• https://www.x41-dsec.de/lab/advisories/x41-2016-001-libotr/Exploit
• http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00021.htmlMailing List
• http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00030.htmlVendor Advisory
• http://seclists.org/fulldisclosure/2016/Mar/21Exploit, Mailing List, Third Party Advisory
• http://www.debian.org/security/2016/dsa-3512Third Party Advisory
• http://www.securityfocus.com/archive/1/537745/100/0/threadedThird Party Advisory
• http://www.securityfocus.com/bid/84285Third Party Advisory, VDB Entry
• http://www.ubuntu.com/usn/USN-2926-1Third Party Advisory
• https://lists.cypherpunks.ca/pipermail/otr-users/2016-March/002581.htmlExploit
• https://security.gentoo.org/glsa/201701-10Third Party Advisory
• https://www.exploit-db.com/exploits/39550/Third Party Advisory, VDB Entry
• https://www.x41-dsec.de/lab/advisories/x41-2016-001-libotr/Exploit

Published

Apr 7, 2016

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2016-2845The Content Security Policy (CSP) implementation in Blink, a…
• CVE-2016-2846Siemens SIMATIC S7-1200 CPU devices before 4.0 allow remote …
• CVE-2016-2847fs/pipe.c in the Linux kernel before 4.5 does not limit the …
• CVE-2016-2848ISC BIND 9.1.0 through 9.8.4-P2 and 9.9.0 through 9.9.2-P2 a…
• CVE-2016-2849Botan before 1.10.13 and 1.11.x before 1.11.29 do not use a …
• CVE-2016-2850Botan 1.11.x before 1.11.29 does not enforce TLS policy for …
• CVE-2016-2853The aufs module for the Linux kernel 3.x and 4.x does not pr…7.8
• CVE-2016-2854The aufs module for the Linux kernel 3.x and 4.x does not pr…7.8
• CVE-2016-2855The Huawei Mobile Broadband HL Service 22.001.25.00.03 and e…
• CVE-2016-2856pt_chown in the glibc package before 2.19-18+deb8u4 on Debia…
• CVE-2016-2857The net_checksum_calculate function in net/checksum.c in QEM…8.4
• CVE-2016-2858QEMU, when built with the Pseudo Random Number Generator (PR…6.5