Vulnerability record · CVE-2015-8833 · published 12 April 2016

CVE-2015-8833: Cypherpunks pidgin-otr vulnerability

CCypherpunks · Pidgin Otr

Use-after-free vulnerability in the create_smp_dialog function in gtk-dialog.c in the Off-the-Record Messaging (OTR) pidgin-otr plugin before 4.0.2 for Pidgin allows remote attackers to execute arbitrary code via vectors related to the "Authenticate buddy" menu item.

9.8 CVSS 3.0 Critical EPSS 7.0% · top 6.0%

9.8CVSS 3.0 base score, v2 10.0

7.0%EPSS exploitation probability, 30 days

NoNot in CISA KEV

1Affected product versions listed by NVD

24References

17 Jun 2026Last modified by NVD

Description

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

CPidgin Otr Cypherpunks

References

Link	Tags
http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00095.html
http://lists.opensuse.org/opensuse-updates/2016-03/msg00109.html
http://www.debian.org/security/2016/dsa-3528
http://www.openwall.com/lists/oss-security/2016/03/09/13
http://www.openwall.com/lists/oss-security/2016/03/09/8
http://www.securityfocus.com/bid/84295
https://blog.fuzzing-project.org/39-Heap-use-after-free-in-Pidgin-OTR-plugin-CVE-2015-8833.html
https://bugs.otr.im/issues/128
https://bugs.otr.im/issues/88
https://bugs.otr.im/projects/pidgin-otr/repository/revisions/aaf551b9dd5cbba8c4abaa3d4dc7ead860efef94
https://lists.cypherpunks.ca/pipermail/otr-users/2016-March/002582.html
https://security.gentoo.org/glsa/201701-10
http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00095.html
http://lists.opensuse.org/opensuse-updates/2016-03/msg00109.html
http://www.debian.org/security/2016/dsa-3528
http://www.openwall.com/lists/oss-security/2016/03/09/13
http://www.openwall.com/lists/oss-security/2016/03/09/8
http://www.securityfocus.com/bid/84295
https://blog.fuzzing-project.org/39-Heap-use-after-free-in-Pidgin-OTR-plugin-CVE-2015-8833.html
https://bugs.otr.im/issues/128
https://bugs.otr.im/issues/88
https://bugs.otr.im/projects/pidgin-otr/repository/revisions/aaf551b9dd5cbba8c4abaa3d4dc7ead860efef94
https://lists.cypherpunks.ca/pipermail/otr-users/2016-March/002582.html
https://security.gentoo.org/glsa/201701-10

Track CVE-2015-8833 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

7.5CVE-2012-2369Cypherpunks pidgin-otr vulnerabilityFormat string vulnerability in the log_message_cb function in otr-plugin.c in the Off-the-Record Messaging (OTR) pidgin-otr plugin before 3.2.1 for P…EPSS 3.5%23 May 2012

Source: NIST National Vulnerability Database (record CVE-2015-8833), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.