CVE-2015-8833

9.8 criticalEPSS 7.0%

Use-after-free vulnerability in the create_smp_dialog function in gtk-dialog.c in the Off-the-Record Messaging (OTR) pidgin-otr plugin before 4.0.2 for Pidgin allows remote attackers to execute arbitrary code via vectors related to the "Authenticate buddy" menu item.

Severity

CVSS 3.0

9.8 critical

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS: 7.0% chance of exploitation in the next 30 days; higher than 94% of CVEs (scores of 2026-10-31)
Published: 2016-04-12
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

cypherpunks:pidgin-otr

References

http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00095.html
http://lists.opensuse.org/opensuse-updates/2016-03/msg00109.html
http://www.debian.org/security/2016/dsa-3528
http://www.openwall.com/lists/oss-security/2016/03/09/13
http://www.openwall.com/lists/oss-security/2016/03/09/8

Check your stack JSON