CVE-2016-2369: Null Pointer Dereference
Published Jan 6, 2017
·Updated
A NULL pointer dereference vulnerability exists in the handling of the MXIT protocol in Pidgin. Specially crafted MXIT data sent via the server could potentially result in a denial of service vulnerability. A malicious server can send a packet starting with a NULL byte triggering the vulnerability.
Affected Software
5 affected components
Pidgin Pidgin<=2.10.12
Canonical Ubuntu Linux=12.04
Canonical Ubuntu Linux=14.04
Canonical Ubuntu Linux=15.10
Debian Debian Linux=8.0
Remediation
Patch Available
Event History
Jan 6, 2017
CVE Published
via MITRE·09:00 PM
Data Sourced
via MITRE·09:00 PM
DescriptionWeakness
Data Sourced
via NVD·09:59 PM
RemedyDescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2016-2369?
CVE-2016-2369 is classified as a denial of service vulnerability.
2
How do I fix CVE-2016-2369?
To fix CVE-2016-2369, update Pidgin to the latest version beyond 2.10.12.
3
Which software versions are affected by CVE-2016-2369?
CVE-2016-2369 affects Pidgin versions up to 2.10.12 and specific versions of Ubuntu and Debian.
4
What is the nature of the vulnerability in CVE-2016-2369?
CVE-2016-2369 involves a NULL pointer dereference due to maliciously crafted MXIT data.
5
Can CVE-2016-2369 lead to exploitation by attackers?
Yes, attackers can exploit CVE-2016-2369 to cause an application crash or denial of service.