CVE-2016-2372: Infoleak
An information leak exists in the handling of the MXIT protocol in Pidgin. Specially crafted MXIT data sent via the server could potentially result in an out-of-bounds read. A malicious user, server, or man-in-the-middle attacker can send an invalid size for a file transfer which will trigger an out-of-bounds read vulnerability. This could result in a denial of service or copy data from memory to the file, resulting in an information leak if the file is sent to another user.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2016-2372?
CVE-2016-2372 has been classified as a moderate severity vulnerability due to its potential for information leakage.
How do I fix CVE-2016-2372?
To resolve CVE-2016-2372, update Pidgin to version 2.10.13 or later.
What software is affected by CVE-2016-2372?
CVE-2016-2372 affects Pidgin versions up to and including 2.10.12, and specific versions of Ubuntu and Debian.
What type of attack does CVE-2016-2372 involve?
CVE-2016-2372 can be exploited via specially crafted MXIT data that leads to an out-of-bounds read.
Is CVE-2016-2372 a remote or local vulnerability?
CVE-2016-2372 is a remote vulnerability that can be exploited by a malicious server or a man-in-the-middle attacker.