CVE-2016-2377: Buffer Overflow
A buffer overflow vulnerability exists in the handling of the MXIT protocol in Pidgin. Specially crafted MXIT data sent by the server could potentially result in an out-of-bounds write of one byte. A malicious server can send a negative content-length in response to a HTTP request triggering the vulnerability.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2016-2377?
CVE-2016-2377 has a high severity rating due to its potential for buffer overflow leading to out-of-bounds writes.
How do I fix CVE-2016-2377?
To fix CVE-2016-2377, update Pidgin to the latest version beyond 2.10.12 or apply the relevant patches provided by your OS distributor.
What versions of Pidgin are affected by CVE-2016-2377?
CVE-2016-2377 affects all versions of Pidgin up to and including 2.10.12.
On which platforms does CVE-2016-2377 exist?
CVE-2016-2377 affects Pidgin on platforms including Ubuntu Linux 12.04, 14.04, and 15.10, as well as Debian Linux 8.0.
What causes the vulnerability in CVE-2016-2377?
The vulnerability in CVE-2016-2377 is triggered by specially crafted MXIT protocol data from a malicious server leading to a buffer overflow.