CVE-2016-2374

Опубликовано: 06 янв. 2017

Источник: nvd

CVSS3: 8.1

CVSS2: 6.8

EPSS Низкий

Описание

An exploitable memory corruption vulnerability exists in the handling of the MXIT protocol in Pidgin. Specially crafted MXIT MultiMX message sent via the server can result in an out-of-bounds write leading to memory disclosure and code execution.

Ссылки

http://www.debian.org/security/2016/dsa-3620
Third Party Advisory
http://www.pidgin.im/news/security/?id=107
Patch
Vendor Advisory
http://www.securityfocus.com/bid/91335
Third Party Advisory
VDB Entry
http://www.talosintelligence.com/reports/TALOS-2016-0142/
Technical Description
Third Party Advisory
http://www.ubuntu.com/usn/USN-3031-1
Third Party Advisory
https://security.gentoo.org/glsa/201701-38
http://www.debian.org/security/2016/dsa-3620
Third Party Advisory
http://www.pidgin.im/news/security/?id=107
Patch
Vendor Advisory
http://www.securityfocus.com/bid/91335
Third Party Advisory
VDB Entry
http://www.talosintelligence.com/reports/TALOS-2016-0142/
Technical Description
Third Party Advisory
http://www.ubuntu.com/usn/USN-3031-1
Third Party Advisory
https://security.gentoo.org/glsa/201701-38

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:pidgin:pidgin:*:*:*:*:*:*:*:*

Версия до 2.10.12 (включая)

Конфигурация 2

Одно из

cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:lts:*:*:*

cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:lts:*:*:*

cpe:2.3:o:canonical:ubuntu_linux:15.10:*:*:*:*:*:*:*

Конфигурация 3

cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*

EPSS

Процентиль: 86%

0.02781

Низкий

8.1 High

CVSS3

6.8 Medium

CVSS2

Дефекты

CWE-125

Связанные уязвимости

CVE-2016-2374

CVSS3: 8.1

ubuntu

около 9 лет назад

CVE-2016-2374

CVSS3: 5.6

redhat

больше 9 лет назад

CVE-2016-2374

CVSS3: 8.1

debian

около 9 лет назад

An exploitable memory corruption vulnerability exists in the handling ...

GHSA-qm22-h7gg-wr34

CVSS3: 8.1

github

больше 3 лет назад

EPSS

Процентиль: 86%

0.02781

Низкий

8.1 High

CVSS3

6.8 Medium

CVSS2

Дефекты

CWE-125