{"id":"CVE-2016-6271","details":"The Bzrtp library (aka libbzrtp) 1.0.x before 1.0.4 allows man-in-the-middle attackers to conduct spoofing attacks by leveraging a missing HVI check on DHPart2 packet reception.","modified":"2026-07-08T12:53:01.583233Z","published":"2017-01-18T22:59:00.780Z","references":[{"type":"WEB","url":"http://www.securityfocus.com/bid/95928"},{"type":"FIX","url":"https://github.com/BelledonneCommunications/bzrtp/commit/bbb1e6e2f467ee4bd7b9a8c800e4f07343d7d99b"},{"type":"PACKAGE","url":"https://github.com/gteissier/CVE-2016-6271"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/belledonnecommunications/bzrtp","events":[{"introduced":"559e7507784cbfb012b486cd1ec621cf3a7c7618"},{"last_affected":"b139a0639127c8c3e46d99964427a9a57d7595c2"},{"fixed":"bbb1e6e2f467ee4bd7b9a8c800e4f07343d7d99b"}],"database_specific":{"cpe":["cpe:2.3:a:bzrtp_project:bzrtp:1.0.0:*:*:*:*:*:*:*","cpe:2.3:a:bzrtp_project:bzrtp:1.0.2:*:*:*:*:*:*:*","cpe:2.3:a:bzrtp_project:bzrtp:1.0.3:*:*:*:*:*:*:*"],"extracted_events":[{"introduced":"1.0.0"},{"last_affected":"1.0.0"},{"introduced":"1.0.2"},{"last_affected":"1.0.2"},{"introduced":"1.0.3"},{"last_affected":"1.0.3"}],"source":["CPE_STRING","REFERENCES"]}}],"versions":["1.0.0","1.0.2","1.0.3"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2016-6271.json","vanir_signatures_modified":"2026-07-08T12:53:01Z","vanir_signatures":[{"target":{"file":"test/bzrtpTest.c"},"deprecated":false,"digest":{"line_hashes":["39193105924607668272250138042150215915","161611720945893536351843179455825897374","59026929521637232435871698970082381378","121046430960441798993995952367385948002"],"threshold":0.9},"id":"CVE-2016-6271-7e03ca87","signature_type":"Line","signature_version":"v1","source":"https://github.com/belledonnecommunications/bzrtp/commit/bbb1e6e2f467ee4bd7b9a8c800e4f07343d7d99b"},{"source":"https://github.com/belledonnecommunications/bzrtp/commit/bbb1e6e2f467ee4bd7b9a8c800e4f07343d7d99b","target":{"file":"src/packetParser.c","function":"bzrtp_packetParser"},"deprecated":false,"digest":{"function_hash":"66355637971267211944685175048683152851","length":12311},"id":"CVE-2016-6271-80760305","signature_type":"Function","signature_version":"v1"},{"deprecated":false,"digest":{"line_hashes":["72925959846706030620584963699996732637","113490524439999342149187249345807459014","334138754210014708556229831642139801828","100172353912423640185507197280053668840","293606029472866719560543630395000067264","64147902449408370850796313724544928103","274456228174394702745469764665481484836","7003787851486458467213035817142872979","163013223040820777858031349166310093379","77506339242188681164775677969084742188","327548673615170004622307055585458835816","335035038758524611663181775161782953025","261194366961044613883088910070508461931","196345374842831575354194454214999777207","333172544096335675575006705150085187482","96968590439802370366782144259403007832","151906791414295325389828161078466189906","295667856615684346584874383307993272476","180767851715536242837363364224127282728","107293213705132986484827100554186938197"],"threshold":0.9},"id":"CVE-2016-6271-ae5466ff","signature_type":"Line","signature_version":"v1","source":"https://github.com/belledonnecommunications/bzrtp/commit/bbb1e6e2f467ee4bd7b9a8c800e4f07343d7d99b","target":{"file":"test/bzrtpParserTest.c"}},{"deprecated":false,"digest":{"function_hash":"272225868753653681046653979833301609337","length":4405},"id":"CVE-2016-6271-bb63a3f1","signature_type":"Function","signature_version":"v1","source":"https://github.com/belledonnecommunications/bzrtp/commit/bbb1e6e2f467ee4bd7b9a8c800e4f07343d7d99b","target":{"file":"test/bzrtpParserTest.c","function":"test_parser"}},{"target":{"file":"test/bzrtpParserTest.h"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["279319553541851576540462727661569971516"]},"id":"CVE-2016-6271-cd806773","signature_type":"Line","signature_version":"v1","source":"https://github.com/belledonnecommunications/bzrtp/commit/bbb1e6e2f467ee4bd7b9a8c800e4f07343d7d99b"},{"id":"CVE-2016-6271-f8bbc7b1","signature_type":"Function","signature_version":"v1","source":"https://github.com/belledonnecommunications/bzrtp/commit/bbb1e6e2f467ee4bd7b9a8c800e4f07343d7d99b","target":{"function":"main","file":"test/bzrtpTest.c"},"deprecated":false,"digest":{"function_hash":"183045543497994461123045877589364690699","length":1370}}]}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"}]}