Vulnerability Name:

CVE-2016-2371 (CCN-114374)

Assigned:2016-06-21
Published:2016-06-21
Updated:2017-03-30
Summary:An out-of-bounds write vulnerability exists in the handling of the MXIT protocol in Pidgin. Specially crafted MXIT data sent via the server could cause memory corruption resulting in code execution.
CVSS v3 Severity:8.1 High (CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H)
7.1 High (Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:U/RC:R)
Exploitability Metrics:Attack Vector (AV): Network
Attack Complexity (AC): High
Privileges Required (PR): None
User Interaction (UI): None
Scope:Scope (S): Unchanged
Impact Metrics:Confidentiality (C): High
Integrity (I): High
Availibility (A): High
7.3 High (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L)
6.4 Medium (CCN Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:U/RL:U/RC:R)
Exploitability Metrics:Attack Vector (AV): Network
Attack Complexity (AC): Low
Privileges Required (PR): None
User Interaction (UI): None
Scope:Scope (S): Unchanged
Impact Metrics:Confidentiality (C): Low
Integrity (I): Low
Availibility (A): Low
CVSS v2 Severity:6.8 Medium (CVSS v2 Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Medium
Authentication (Au): None
Impact Metrics:Confidentiality (C): Partial
Integrity (I): Partial
Availibility (A): Partial
7.5 High (CCN CVSS v2 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Low
Athentication (Au): None
Impact Metrics:Confidentiality (C): Partial
Integrity (I): Partial
Availibility (A): Partial
Vulnerability Type:CWE-787
Vulnerability Consequences:Gain Access
References:Source: MITRE
Type: CNA
CVE-2016-2371

Source: DEBIAN
Type: Third Party Advisory
DSA-3620

Source: CONFIRM
Type: Patch, Vendor Advisory
http://www.pidgin.im/news/security/?id=104

Source: BID
Type: Third Party Advisory, VDB Entry
91335

Source: CCN
Type: Talos Vulnerability Report TALOS-2016-0139
Pidgin MXIT Extended Profiles Code Execution Vulnerability

Source: MISC
Type: Technical Description, Third Party Advisory
http://www.talosintelligence.com/reports/TALOS-2016-0139/

Source: UBUNTU
Type: Third Party Advisory
USN-3031-1

Source: XF
Type: UNKNOWN
pidgin-cve20162371-code-exec(114374)

Source: GENTOO
Type: UNKNOWN
GLSA-201701-38

Source: CCN
Type: Pidgin Web site
Pidgin, the universal chat client

Vulnerable Configuration:Configuration 1:
  • cpe:/a:pidgin:pidgin:*:*:*:*:*:*:*:* (Version <= 2.10.12)

    • Configuration 2:
  • cpe:/o:canonical:ubuntu_linux:12.04:*:*:*:lts:*:*:*
  • OR cpe:/o:canonical:ubuntu_linux:14.04:*:*:*:lts:*:*:*
  • OR cpe:/o:canonical:ubuntu_linux:15.10:*:*:*:*:*:*:*

    • Configuration 3:
  • cpe:/o:debian:debian_linux:8.0:*:*:*:*:*:*:*

    • Configuration CCN 1:
  • cpe:/a:pidgin:pidgin:2.10.11:*:*:*:*:*:*:*

    • * Denotes that component is vulnerable
    Oval Definitions
    Definition IDClassTitleLast Modified
    oval:org.opensuse.security:def:20162371
    V
    		CVE-2016-2371
    2021-08-15
    oval:org.opensuse.security:def:28353
    P
    		Security update for pidgin (Important)
    2020-12-01
    oval:org.opensuse.security:def:27481
    P
    		librsvg-devel on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:26905
    P
    		glibc on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:27636
    P
    		Security update for OpenSSL
    2020-12-01
    oval:org.opensuse.security:def:27189
    P
    		libgtop on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:27534
    P
    		perl-Tk-devel on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:26916
    P
    		hplip on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:27680
    P
    		Security update for Xen
    2020-12-01
    oval:org.opensuse.security:def:27246
    P
    		nagios-nrpe on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:27583
    P
    		xorg-x11-libXext-devel-32bit on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:26980
    P
    		libxcrypt on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:28318
    P
    		Security update for openssl (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:27330
    P
    		xorg-x11-libXext-32bit on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:26904
    P
    		glib2 on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:27622
    P
    		Security update for icu
    2020-12-01
    oval:org.opensuse.security:def:27108
    P
    		dbus-1-glib on GA media (Moderate)
    2020-12-01
    oval:com.ubuntu.precise:def:20162371000
    V
    		CVE-2016-2371 on Ubuntu 12.04 LTS (precise) - medium.
    2017-01-06
    oval:com.ubuntu.trusty:def:20162371000
    V
    		CVE-2016-2371 on Ubuntu 14.04 LTS (trusty) - medium.
    2017-01-06
    oval:com.ubuntu.xenial:def:201623710000000
    V
    		CVE-2016-2371 on Ubuntu 16.04 LTS (xenial) - medium.
    2017-01-06
    oval:com.ubuntu.xenial:def:20162371000
    V
    		CVE-2016-2371 on Ubuntu 16.04 LTS (xenial) - medium.
    2017-01-06
    oval:org.cisecurity:def:967
    P
    		DSA-3620-1 -- pidgin -- security update
    2016-08-26
    BACK
    pidgin pidgin *
    canonical ubuntu linux 12.04
    canonical ubuntu linux 14.04
    canonical ubuntu linux 15.10
    debian debian linux 8.0
    pidgin pidgin 2.10.11