CVE-2016-2367

An information leak exists in the handling of the MXIT protocol in Pidgin. Specially crafted MXIT data sent via the server could potentially result in an out-of-bounds read. A malicious user, server, or man-in-the-middle can send an invalid size for an avatar which will trigger an out-of-bounds read vulnerability. This could result in a denial of service or copy data from memory to the file, resulting in an information leak if the avatar is sent to another user.

CVSS v3.0 5.9 MEDIUM
CVSS v2.0 3.5 LOW

5.9^/10

CVSS v3.0 : MEDIUM

Vector : AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

Exploitability : 2.2 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

3.5^/10

CVSS v2.0 : LOW

Vector : AV:N/AC:M/Au:S/C:N/I:N/A:P

Exploitability : 6.8 / Impact : 2.9

Access Vector NETWORK

Access Complexity MEDIUM

Authentication SINGLE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact PARTIAL

References

Link	Resource
http://www.ubuntu.com/usn/USN-3031-1	Third Party Advisory
http://www.talosintelligence.com/reports/TALOS-2016-0135/	Technical Description Third Party Advisory
http://www.pidgin.im/news/security/?id=100	Patch Vendor Advisory
http://www.debian.org/security/2016/dsa-3620	Third Party Advisory
http://www.securityfocus.com/bid/91335	Third Party Advisory VDB Entry
https://security.gentoo.org/glsa/201701-38

Advertisement

Configurations

Configuration 1 (hide)

cpe:2.3:a:pidgin:pidgin:*:*:*:*:*:*:*:*

Configuration 2 (hide)

OR	cpe:2.3:o:canonical:ubuntu_linux:15.10:::::::*
	cpe:2.3:o:canonical:ubuntu_linux:12.04::::lts:::
	cpe:2.3:o:canonical:ubuntu_linux:14.04::::lts:::

Configuration 3 (hide)

cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*

Information

Published : 2017-01-06 13:59

Updated : 2017-03-29 18:59

NVD link : CVE-2016-2367

Mitre link : CVE-2016-2367

JSON object : View

CWE

CWE-125

Out-of-bounds Read

CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

Advertisement

Products Affected

debian

debian_linux

canonical

ubuntu_linux

pidgin

pidgin

{"cve": {"data_type": "CVE", "references": {"reference_data": [{"url": "http://www.ubuntu.com/usn/USN-3031-1", "name": "USN-3031-1", "tags": ["Third Party Advisory"], "refsource": "UBUNTU"}, {"url": "http://www.talosintelligence.com/reports/TALOS-2016-0135/", "name": "http://www.talosintelligence.com/reports/TALOS-2016-0135/", "tags": ["Technical Description", "Third Party Advisory"], "refsource": "MISC"}, {"url": "http://www.pidgin.im/news/security/?id=100", "name": "http://www.pidgin.im/news/security/?id=100", "tags": ["Patch", "Vendor Advisory"], "refsource": "CONFIRM"}, {"url": "http://www.debian.org/security/2016/dsa-3620", "name": "DSA-3620", "tags": ["Third Party Advisory"], "refsource": "DEBIAN"}, {"url": "http://www.securityfocus.com/bid/91335", "name": "91335", "tags": ["Third Party Advisory", "VDB Entry"], "refsource": "BID"}, {"url": "https://security.gentoo.org/glsa/201701-38", "name": "GLSA-201701-38", "tags": [], "refsource": "GENTOO"}]}, "data_format": "MITRE", "description": {"description_data": [{"lang": "en", "value": "An information leak exists in the handling of the MXIT protocol in Pidgin. Specially crafted MXIT data sent via the server could potentially result in an out-of-bounds read. A malicious user, server, or man-in-the-middle can send an invalid size for an avatar which will trigger an out-of-bounds read vulnerability. This could result in a denial of service or copy data from memory to the file, resulting in an information leak if the avatar is sent to another user."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "en", "value": "CWE-200"}, {"lang": "en", "value": "CWE-125"}]}]}, "data_version": "4.0", "CVE_data_meta": {"ID": "CVE-2016-2367", "ASSIGNER": "cert@cert.org"}}, "impact": {"baseMetricV2": {"cvssV2": {"version": "2.0", "baseScore": 3.5, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:S/C:N/I:N/A:P", "authentication": "SINGLE", "integrityImpact": "NONE", "accessComplexity": "MEDIUM", "availabilityImpact": "PARTIAL", "confidentialityImpact": "NONE"}, "severity": "LOW", "impactScore": 2.9, "obtainAllPrivilege": false, "exploitabilityScore": 6.8, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}, "baseMetricV3": {"cvssV3": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 5.9, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 2.2}}, "publishedDate": "2017-01-06T21:59Z", "configurations": {"nodes": [{"children": [], "operator": "OR", "cpe_match": [{"cpe23Uri": "cpe:2.3:a:pidgin:pidgin:*:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true, "versionEndIncluding": "2.10.12"}]}, {"children": [], "operator": "OR", "cpe_match": [{"cpe23Uri": "cpe:2.3:o:canonical:ubuntu_linux:15.10:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:lts:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:lts:*:*:*", "cpe_name": [], "vulnerable": true}]}, {"children": [], "operator": "OR", "cpe_match": [{"cpe23Uri": "cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}]}], "CVE_data_version": "4.0"}, "lastModifiedDate": "2017-03-30T01:59Z"}