Vulnerability CVE-2016-2378

Vulnerability CVE-2016-2378

Published: 2017-01-06 Modified: 2017-01-07

Description:

A buffer overflow vulnerability exists in the handling of the MXIT protocol Pidgin. Specially crafted data sent via the server could potentially result in a buffer overflow, potentially resulting in memory corruption. A malicious server or an unfiltered malicious user can send negative length values to trigger this vulnerability.

CVSS2 => (AV:N/AC:M/Au:N/C:P/I:P/A:P)

CVSS Base Score	Impact Subscore	Exploitability Subscore
6.8/10	6.4/10	8.6/10

Exploit range	Attack complexity	Authentication
Remote	Medium	No required
Confidentiality impact	Integrity impact	Availability impact
Partial	Partial	Partial

Affected software
Pidgin -> Pidgin
Debian -> Debian linux
Canonical -> Ubuntu linux

References:

http://www.debian.org/security/2016/dsa-3620

http://www.pidgin.im/news/security/?id=94

http://www.securityfocus.com/bid/91335

http://www.talosintelligence.com/reports/TALOS-2016-0120/

http://www.ubuntu.com/usn/USN-3031-1

https://security.gentoo.org/glsa/201701-38

Copyright 2024, cxsecurity.com