CVE-2016-4323

NONE EPSS 81.2%

Published Jan 6, 20179y ago · Modified Jun 17, 20262w ago

Published Jan 6, 2017 9y ago

Last Modified Jun 17, 2026 2w ago

Description

A directory traversal exists in the handling of the MXIT protocol in Pidgin. Specially crafted MXIT data sent from the server could potentially result in an overwrite of files. A malicious server or someone with access to the network traffic can provide an invalid filename for a splash image triggering the vulnerability.

Threat Intelligence

EPSS Exploit Probability

81.2% percentile

Exploit & Patch Status

Public Exploit Known

Patch Available

Weaknesses 1

CWE-22 Path Traversal Resource Mgmt

Affected Products 5

Vendor	Product	Version	Range
pidgin	pidgin	*	≤2.10.12
canonical	ubuntu_linux	12.04	any
canonical	ubuntu_linux	14.04	any
canonical	ubuntu_linux	15.10	any
debian	debian_linux	8.0	any

References 6

debian.org http://www.debian.org/security/2016/dsa-3620

Third Party Advisory
pidgin.im http://www.pidgin.im/news/security/?id=97

PatchVendor Advisory
securityfocus.com http://www.securityfocus.com/bid/91335
talosintelligence.com http://www.talosintelligence.com/reports/TALOS-2016-0128/

ExploitThird Party Advisory
ubuntu.com http://www.ubuntu.com/usn/USN-3031-1

Third Party Advisory
security.gentoo.org https://security.gentoo.org/glsa/201701-38

Remediation

pidgin.im http://www.pidgin.im/news/security/?id=97

PatchVendor Advisory