CVE-2016-2374

Опубликовано: 06 янв. 2017

Источник: nvd

CVSS3: 8.1

CVSS2: 6.8

EPSS Низкий

Описание

An exploitable memory corruption vulnerability exists in the handling of the MXIT protocol in Pidgin. Specially crafted MXIT MultiMX message sent via the server can result in an out-of-bounds write leading to memory disclosure and code execution.

Ссылки

http://www.debian.org/security/2016/dsa-3620
Third Party Advisory
http://www.pidgin.im/news/security/?id=107
Patch
Vendor Advisory
http://www.securityfocus.com/bid/91335
Third Party Advisory
VDB Entry
http://www.talosintelligence.com/reports/TALOS-2016-0142/
Technical Description
Third Party Advisory
http://www.ubuntu.com/usn/USN-3031-1
Third Party Advisory
https://security.gentoo.org/glsa/201701-38
http://www.debian.org/security/2016/dsa-3620
Third Party Advisory
http://www.pidgin.im/news/security/?id=107
Patch
Vendor Advisory
http://www.securityfocus.com/bid/91335
Third Party Advisory
VDB Entry
http://www.talosintelligence.com/reports/TALOS-2016-0142/
Technical Description
Third Party Advisory
http://www.ubuntu.com/usn/USN-3031-1
Third Party Advisory
https://security.gentoo.org/glsa/201701-38

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:pidgin:pidgin:*:*:*:*:*:*:*:*

Версия до 2.10.12 (включая)

Конфигурация 2

Одно из

cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:lts:*:*:*

cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:lts:*:*:*

cpe:2.3:o:canonical:ubuntu_linux:15.10:*:*:*:*:*:*:*

Конфигурация 3

cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*

EPSS

Процентиль: 87%

0.03228

Низкий

8.1 High

CVSS3

6.8 Medium

CVSS2

Дефекты

CWE-125

Связанные уязвимости

CVE-2016-2374

CVSS3: 8.1

ubuntu

больше 9 лет назад

CVE-2016-2374

CVSS3: 5.6

redhat

около 10 лет назад

CVE-2016-2374

CVSS3: 8.1

debian

больше 9 лет назад

An exploitable memory corruption vulnerability exists in the handling ...

GHSA-qm22-h7gg-wr34

CVSS3: 8.1

github

больше 4 лет назад

EPSS

Процентиль: 87%

0.03228

Низкий

8.1 High

CVSS3

6.8 Medium

CVSS2

Дефекты

CWE-125