CVE-2016-2374

HighCVSS 8.1/10Last modified Jun 17, 2026

Description

An exploitable memory corruption vulnerability exists in the handling of the MXIT protocol in Pidgin. Specially crafted MXIT MultiMX message sent via the server can result in an out-of-bounds write leading to memory disclosure and code execution.

Metrics

CVSS 3.0 8.1/10CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-125 CWE-200

Affected software

Vendor	Product	Versions
Pidgin	Pidgin	2.10.11

References

http://www.debian.org/security/2016/dsa-3620Third Party Advisory
http://www.pidgin.im/news/security/?id=107Patch, Vendor Advisory
http://www.securityfocus.com/bid/91335Third Party Advisory, VDB Entry
http://www.talosintelligence.com/reports/TALOS-2016-0142/Technical Description, Third Party Advisory
http://www.ubuntu.com/usn/USN-3031-1Third Party Advisory
https://security.gentoo.org/glsa/201701-38
http://www.debian.org/security/2016/dsa-3620Third Party Advisory
http://www.pidgin.im/news/security/?id=107Patch, Vendor Advisory
http://www.securityfocus.com/bid/91335Third Party Advisory, VDB Entry
http://www.talosintelligence.com/reports/TALOS-2016-0142/Technical Description, Third Party Advisory
http://www.ubuntu.com/usn/USN-3031-1Third Party Advisory
https://security.gentoo.org/glsa/201701-38

Timeline

Published: Jan 6, 2017
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2016

CVE-2016-23755.3An exploitable out-of-bounds read exists in the handling of the MXIT protocol in Pidgin. Specially crafted MXIT contact information sent fro CVE-2016-23768.1A buffer overflow vulnerability exists in the handling of the MXIT protocol in Pidgin. Specially crafted MXIT data sent from the server coul CVE-2016-23778.1A buffer overflow vulnerability exists in the handling of the MXIT protocol in Pidgin. Specially crafted MXIT data sent by the server could CVE-2016-23788.1A buffer overflow vulnerability exists in the handling of the MXIT protocol Pidgin. Specially crafted data sent via the server could potenti CVE-2016-23798.8The Mxit protocol uses weak encryption when encrypting user passwords, which might allow attackers to (1) decrypt hashed passwords by levera CVE-2016-23803.1An information leak exists in the handling of the MXIT protocol in Pidgin. Specially crafted MXIT data sent to the server could potentially CVE-2016-23817.5Perl might allow context-dependent attackers to bypass the taint protection mechanism in a child process via duplicate environment variables CVE-2016-23835.5The adjust_branches function in kernel/bpf/verifier.c in the Linux kernel before 4.5 does not consider the delta in the backward-jump case, CVE-2016-23844.6Double free vulnerability in the snd_usbmidi_create function in sound/usb/midi.c in the Linux kernel before 4.5 allows physically proximate CVE-2016-23859.8Heap-based buffer overflow in the encode_msg function in encode_msg.c in the SEAS module in Kamailio (formerly OpenSER and SER) before 4.3.5 CVE-2016-23869.8SQL injection vulnerability in the UDDI server in SAP NetWeaver J2EE Engine 7.40 allows remote attackers to execute arbitrary SQL commands v CVE-2016-23876.1Multiple cross-site scripting (XSS) vulnerabilities in the Java Proxy Runtime ProxyServer servlet in SAP NetWeaver 7.4 allow remote attacker