CVE-2016-2369

NONE EPSS 80.7%
Published Jan 6, 20179y ago · Modified Jun 17, 20262w ago
Find Similar
Published Jan 6, 2017 9y ago
Last Modified Jun 17, 2026 2w ago

Description

A NULL pointer dereference vulnerability exists in the handling of the MXIT protocol in Pidgin. Specially crafted MXIT data sent via the server could potentially result in a denial of service vulnerability. A malicious server can send a packet starting with a NULL byte triggering the vulnerability.

Threat Intelligence

EPSS Exploit Probability
80.7% percentile
Exploit & Patch Status
No Known Exploit
Patch Available

Weaknesses 1

CWE-476 NULL Pointer Dereference Memory Safety

Affected Products 5

VendorProductVersionRange
pidginpidgin* ≤2.10.12
canonicalubuntu_linux12.04any
canonicalubuntu_linux14.04any
canonicalubuntu_linux15.10any
debiandebian_linux8.0any

References 6

  • debian.org http://www.debian.org/security/2016/dsa-3620
    Third Party Advisory
  • pidgin.im http://www.pidgin.im/news/security/?id=102
    PatchVendor Advisory
  • securityfocus.com http://www.securityfocus.com/bid/91335
    Third Party AdvisoryVDB Entry
  • talosintelligence.com http://www.talosintelligence.com/reports/TALOS-2016-0137/
    Technical DescriptionThird Party Advisory
  • ubuntu.com http://www.ubuntu.com/usn/USN-3031-1
    Third Party Advisory
  • security.gentoo.org https://security.gentoo.org/glsa/201701-38

Remediation

  • pidgin.im http://www.pidgin.im/news/security/?id=102
    PatchVendor Advisory