CVE-2016-2367: Infoleak
An information leak exists in the handling of the MXIT protocol in Pidgin. Specially crafted MXIT data sent via the server could potentially result in an out-of-bounds read. A malicious user, server, or man-in-the-middle can send an invalid size for an avatar which will trigger an out-of-bounds read vulnerability. This could result in a denial of service or copy data from memory to the file, resulting in an information leak if the avatar is sent to another user.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2016-2367?
CVE-2016-2367 is classified as a medium severity vulnerability due to potential information leakage.
How do I fix CVE-2016-2367?
To fix CVE-2016-2367, update Pidgin to version 2.10.12 or later.
Which software is affected by CVE-2016-2367?
CVE-2016-2367 affects Pidgin versions up to 2.10.12 and several versions of Ubuntu and Debian Linux.
What type of vulnerability is CVE-2016-2367?
CVE-2016-2367 is an information leak vulnerability caused by the handling of the MXIT protocol.
Can attackers exploit CVE-2016-2367 remotely?
Yes, attackers can exploit CVE-2016-2367 remotely, potentially through specially crafted MXIT data.