CVE-2016-2372
mediumpriority · track · 25EPSS 0.018 · 78 %ileEUUSEPSS · scored 2026-10-27
An information leak exists in the handling of the MXIT protocol in Pidgin. Specially crafted MXIT data sent via the server could potentially result in an out-of-bounds read. A malicious user, server, or man-in-the-middle attacker can send an invalid size for a file transfer which will trigger an out-of-bounds read vulnerability. This could result in a denial of service or copy data from memory to the file, resulting in an information leak if the file is sent to another user.
cvss
Technical severity, 0–10. One row per scoring source.
base score 0–10 · higher = more severe · hover a vector to decode
weaknesses
The CWE weakness classes this flaw belongs to.
affected products (6)
Products and version ranges known to be affected.
also known as (3)
Other names and identifiers for this entity.
sources
Which sources assert this record, and when.
references (17)
External citations — patches, advisories, analysis.
- http://www.debian.org/security/2016/dsa-3620cnnvd
- http://www.pidgin.im/news/security/?id=105cnnvd
- http://www.talosintelligence.com/reports/TALOS-2016-0140/cnnvd
- http://www.ubuntu.com/usn/USN-3031-1cnnvd
- https://pidgin.im/news/security/?id=105Patchcnnvd
- http://www.debian.org/security/2016/dsa-3620enisa_euvd
- http://www.pidgin.im/news/security/?id=105enisa_euvd
- http://www.securityfocus.com/bid/91335enisa_euvd
Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.
Free scan