PT-2016-5143

CVE-2016-2374

Published

2016-06-23

Updated

2017-03-30

Description by

CVSS 3.1

8.1

High

MetricsAV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Pidgin (affected versions not specified)

Description A memory corruption issue exists in Pidgin's handling of the MXIT protocol. This is caused by specially crafted MXIT MultiMX messages sent via the server, which can lead to an out-of-bounds write. As a result, this can cause memory disclosure and potentially allow code execution.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Impacts

Researchers

Yves Younan

Vendors

Affected products

Weakness enumeration

CWE-200: Exposure of Sensitive Information to an Unauthorized Actor

CWE-125: Out-of-bounds Read

Related identifiers

CVE-2016-2374

ALT-PU-2016-1727