CVE-2016-2372

Publication date 23 June 2016

Last updated 25 August 2025

Ubuntu priority

Low

Why this priority?

Cvss 3 Severity Score

5.9 · Medium

Score breakdown

Description

An information leak exists in the handling of the MXIT protocol in Pidgin. Specially crafted MXIT data sent via the server could potentially result in an out-of-bounds read. A malicious user, server, or man-in-the-middle attacker can send an invalid size for a file transfer which will trigger an out-of-bounds read vulnerability. This could result in a denial of service or copy data from memory to the file, resulting in an information leak if the file is sent to another user.

Read the notes from the security team

Status

Package Ubuntu Release Status
pidgin 16.04 LTS xenial
Fixed 1:2.10.12-0ubuntu5.1
15.10 wily
Fixed 1:2.10.11-0ubuntu4.2
14.04 LTS trusty
Fixed 1:2.10.9-0ubuntu3.3
12.04 LTS precise
Fixed 1:2.10.3-0ubuntu1.7

Notes

mdeslaur

same commits as CVE-2016-2367

Patch details

For informational purposes only. We recommend not to cherry-pick updates. How can I get the fixes?

Package Patch details
pidgin

Severity score breakdown

CVSS version: CVSS v3.0

Base score 5.9 · Medium

Vector: CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:H

References

Related Ubuntu Security Notices (USN)

Other references

Access our resources on patching vulnerabilities