CVE-2016-2374

NONE EPSS 86.7%

Published Jan 6, 20179y ago · Modified Jun 17, 20262w ago

Published Jan 6, 2017 9y ago

Last Modified Jun 17, 2026 2w ago

Description

An exploitable memory corruption vulnerability exists in the handling of the MXIT protocol in Pidgin. Specially crafted MXIT MultiMX message sent via the server can result in an out-of-bounds write leading to memory disclosure and code execution.

Threat Intelligence

EPSS Exploit Probability

86.7% percentile

Exploit & Patch Status

No Known Exploit

Patch Available

Weaknesses 2

CWE-125 Out-of-bounds Read Memory Safety

CWE-200 Exposure of Sensitive Information to an Unauthorized Actor Information Exposure

Affected Products 5

Vendor	Product	Version	Range
pidgin	pidgin	*	≤2.10.12
canonical	ubuntu_linux	12.04	any
canonical	ubuntu_linux	14.04	any
canonical	ubuntu_linux	15.10	any
debian	debian_linux	8.0	any

References 6

debian.org http://www.debian.org/security/2016/dsa-3620

Third Party Advisory
pidgin.im http://www.pidgin.im/news/security/?id=107

PatchVendor Advisory
securityfocus.com http://www.securityfocus.com/bid/91335

Third Party AdvisoryVDB Entry
talosintelligence.com http://www.talosintelligence.com/reports/TALOS-2016-0142/

Technical DescriptionThird Party Advisory
ubuntu.com http://www.ubuntu.com/usn/USN-3031-1

Third Party Advisory
security.gentoo.org https://security.gentoo.org/glsa/201701-38

Remediation

pidgin.im http://www.pidgin.im/news/security/?id=107

PatchVendor Advisory