CVE-2016-2378

NONE EPSS 82.9%
Published Jan 6, 20179y ago · Modified Jun 17, 20262w ago
Find Similar
Published Jan 6, 2017 9y ago
Last Modified Jun 17, 2026 2w ago

Description

A buffer overflow vulnerability exists in the handling of the MXIT protocol Pidgin. Specially crafted data sent via the server could potentially result in a buffer overflow, potentially resulting in memory corruption. A malicious server or an unfiltered malicious user can send negative length values to trigger this vulnerability.

Threat Intelligence

EPSS Exploit Probability
82.9% percentile
Exploit & Patch Status
No Known Exploit
Patch Available

Weaknesses 1

CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer Memory Safety

Affected Products 5

VendorProductVersionRange
pidginpidgin* ≤2.10.12
canonicalubuntu_linux12.04any
canonicalubuntu_linux14.04any
canonicalubuntu_linux15.10any
debiandebian_linux8.0any

References 6

  • debian.org http://www.debian.org/security/2016/dsa-3620
    Third Party Advisory
  • pidgin.im http://www.pidgin.im/news/security/?id=94
    PatchVendor Advisory
  • securityfocus.com http://www.securityfocus.com/bid/91335
    Third Party AdvisoryVDB Entry
  • talosintelligence.com http://www.talosintelligence.com/reports/TALOS-2016-0120/
    Technical DescriptionThird Party Advisory
  • ubuntu.com http://www.ubuntu.com/usn/USN-3031-1
    Third Party Advisory
  • security.gentoo.org https://security.gentoo.org/glsa/201701-38

Remediation

  • pidgin.im http://www.pidgin.im/news/security/?id=94
    PatchVendor Advisory