High
Security advisory
The Bzrtp library (aka libbzrtp) 1.0.x before 1.0.4 allows man-in-the-middle attackers to conduct spoofing attacks by leveraging a missing HVI check on DHPart2 packet reception.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2016-6271
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 31 Oct 2026, 12:11 UTC · Revision 1
Source evidence
The Bzrtp library (aka libbzrtp) 1.0.x before 1.0.4 allows man-in-the-middle attackers to conduct spoofing attacks by leveraging a missing HVI check on DHPart2 packet reception.
osv:CVE-2016-6271
Complete source record
{
"id": "56ac56a53193298ed3e069e9f1c1ebcdbcf376b44fc2126107ad0e60a9594bf9",
"url": "https://osv.dev/vulnerability/CVE-2016-6271",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "CVE-2016-6271",
"summary": "The Bzrtp library (aka libbzrtp) 1.0.x before 1.0.4 allows man-in-the-middle attackers to conduct spoofing attacks by leveraging a missing HVI check on DHPart2 packet reception.",
"evidence": "osv:CVE-2016-6271",
"products": [],
"severity": "high",
"structured": {
"id": "CVE-2016-6271",
"aliases": [
"CVE-2016-6271"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/belledonnecommunications/bzrtp",
"type": "GIT",
"events": [
{
"introduced": "559e7507784cbfb012b486cd1ec621cf3a7c7618"
},
{
"last_affected": "b139a0639127c8c3e46d99964427a9a57d7595c2"
},
{
"fixed": "bbb1e6e2f467ee4bd7b9a8c800e4f07343d7d99b"
}
],
"database_specific": {
"extracted_events": [
{
"cpe": "cpe:2.3:a:bzrtp_project:bzrtp:1.0.0:*:*:*:*:*:*:*",
"range": [
{
"introduced": "1.0.0"
},
{
"last_affected": "1.0.0"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:bzrtp_project:bzrtp:1.0.2:*:*:*:*:*:*:*",
"range": [
{
"introduced": "1.0.2"
},
{
"last_affected": "1.0.2"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:bzrtp_project:bzrtp:1.0.3:*:*:*:*:*:*:*",
"range": [
{
"introduced": "1.0.3"
},
{
"last_affected": "1.0.3"
}
],
"source": "CPE_STRING"
},
{
"range": [
{
"fixed": "bbb1e6e2f467ee4bd7b9a8c800e4f07343d7d99b"
}
],
"source": "REFERENCES_COMMIT"
}
]
}
}
],
"versions": [
"1.0.0",
"1.0.2",
"1.0.3"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2016-6271.json",
"vanir_signatures": [
{
"id": "CVE-2016-6271-7e03ca87",
"digest": {
"threshold": 0.9,
"line_hashes": [
"39193105924607668272250138042150215915",
"161611720945893536351843179455825897374",
"59026929521637232435871698970082381378",
"121046430960441798993995952367385948002"
]
},
"source": "https://github.com/belledonnecommunications/bzrtp/commit/bbb1e6e2f467ee4bd7b9a8c800e4f07343d7d99b",
"target": {
"file": "test/bzrtpTest.c"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2016-6271-80760305",
"digest": {
"length": 12311,
"function_hash": "66355637971267211944685175048683152851"
},
"source": "https://github.com/belledonnecommunications/bzrtp/commit/bbb1e6e2f467ee4bd7b9a8c800e4f07343d7d99b",
"target": {
"file": "src/packetParser.c",
"function": "bzrtp_packetParser"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2016-6271-ae5466ff",
"digest": {
"threshold": 0.9,
"line_hashes": [
"72925959846706030620584963699996732637",
"113490524439999342149187249345807459014",
"334138754210014708556229831642139801828",
"100172353912423640185507197280053668840",
"293606029472866719560543630395000067264",
"64147902449408370850796313724544928103",
"274456228174394702745469764665481484836",
"7003787851486458467213035817142872979",
"163013223040820777858031349166310093379",
"77506339242188681164775677969084742188",
"327548673615170004622307055585458835816",
"335035038758524611663181775161782953025",
"261194366961044613883088910070508461931",
"196345374842831575354194454214999777207",
"333172544096335675575006705150085187482",
"96968590439802370366782144259403007832",
"151906791414295325389828161078466189906",
"295667856615684346584874383307993272476",
"180767851715536242837363364224127282728",
"107293213705132986484827100554186938197"
]
},
"source": "https://github.com/belledonnecommunications/bzrtp/commit/bbb1e6e2f467ee4bd7b9a8c800e4f07343d7d99b",
"target": {
"file": "test/bzrtpParserTest.c"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2016-6271-bb63a3f1",
"digest": {
"length": 4405,
"function_hash": "272225868753653681046653979833301609337"
},
"source": "https://github.com/belledonnecommunications/bzrtp/commit/bbb1e6e2f467ee4bd7b9a8c800e4f07343d7d99b",
"target": {
"file": "test/bzrtpParserTest.c",
"function": "test_parser"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2016-6271-cd806773",
"digest": {
"threshold": 0.9,
"line_hashes": [
"279319553541851576540462727661569971516"
]
},
"source": "https://github.com/belledonnecommunications/bzrtp/commit/bbb1e6e2f467ee4bd7b9a8c800e4f07343d7d99b",
"target": {
"file": "test/bzrtpParserTest.h"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2016-6271-f8bbc7b1",
"digest": {
"length": 1370,
"function_hash": "183045543497994461123045877589364690699"
},
"source": "https://github.com/belledonnecommunications/bzrtp/commit/bbb1e6e2f467ee4bd7b9a8c800e4f07343d7d99b",
"target": {
"file": "test/bzrtpTest.c",
"function": "main"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
}
],
"vanir_signatures_modified": "2026-10-20T13:17:25Z"
}
}
],
"modified": "2026-10-20T13:17:25.980704142Z",
"provider": "osv",
"references": [
"https://github.com/BelledonneCommunications/bzrtp/commit/bbb1e6e2f467ee4bd7b9a8c800e4f07343d7d99b",
"https://github.com/gteissier/CVE-2016-6271"
],
"provider_metadata": {}
},
"related_cves": [
{
"value": "CVE-2016-6271",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 387451,
"published_at": "2017-01-18T22:59:00.78+00:00"
}