CVE-2016-2375

Published: Jan 6, 2017Modified: May 6, 2026

5.3

Vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Exploitability: 3.9 / Impact: 1.4

Source: NVD

Description

An exploitable out-of-bounds read exists in the handling of the MXIT protocol in Pidgin. Specially crafted MXIT contact information sent from the server can result in memory disclosure.

Affected (5)

Products: Pidgin: Pidgin · Canonical: Ubuntu Linux · Debian: Debian Linux

1 product

1 product

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Pidgin Pidgin	Up to 2.10.12

Configuration B

3 vulnerable

Vulnerable Software	Affected Versions
Canonical Ubuntu Linux	Version 12.04
Canonical Ubuntu Linux	Version 14.04
Canonical Ubuntu Linux	Version 15.10

Configuration C

1 vulnerable

Vulnerable Software	Affected Versions
Debian Debian Linux	Version 8.0

Related CWEs

CWE-125

Out-of-bounds Read

The product reads data past the end, or before the beginning, of the intended buffer.

References (12)

http://www.debian.org/security/2016/dsa-3620

Source: cret@cert.org

Third Party Advisory

http://www.pidgin.im/news/security/?id=108

Source: cret@cert.org

PatchVendor Advisory

http://www.securityfocus.com/bid/91335

Source: cret@cert.org

Third Party AdvisoryVDB Entry

http://www.talosintelligence.com/reports/TALOS-2016-0143/

Source: cret@cert.org

Technical DescriptionThird Party Advisory

http://www.ubuntu.com/usn/USN-3031-1

Source: cret@cert.org

Third Party Advisory

https://security.gentoo.org/glsa/201701-38

Source: cret@cert.org

http://www.debian.org/security/2016/dsa-3620