CVE-2017-2640

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

An out-of-bounds write flaw was found in the way Pidgin before 2.12.0 processed XML content. A malicious remote server could potentially use this flaw to crash Pidgin or execute arbitrary code in the context of the pidgin process.

Metrics

CVSS 3.0 9.8/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-787

Affected software

No affected versions have been published.

Timeline

Published: Jul 27, 2018
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2017

CVE-2017-26419.8In Moodle 2.x and 3.x, SQL injection can occur via user preferences.CVE-2017-26426.5Moodle 3.x has user fullname disclosure on the user preferences page.CVE-2017-26435.3In Moodle 3.2.x, global search displays user names for unauthenticated users.CVE-2017-26446.1In Moodle 3.x, XSS can occur via evidence of prior learning.CVE-2017-26456.1In Moodle 3.x, XSS can occur via attachments to evidence of prior learning.CVE-2017-26467.5It was found that when Keycloak before 2.5.5 receives a Logout request with a Extensions in the middle of the request, the SAMLSloRequestPar CVE-2017-26477.8The KEYS subsystem in the Linux kernel before 3.18 allows local users to gain privileges or cause a denial of service (NULL pointer derefere CVE-2017-26485.6It was found that jenkins-ssh-slaves-plugin before version 1.15 did not perform host key verification, thereby enabling Man-in-the-Middle at CVE-2017-26498.1It was found that the Active Directory Plugin for Jenkins up to and including version 2.2 did not verify certificates of the Active Director CVE-2017-26508.5It was found that the use of Pipeline: Classpath Step Jenkins plugin enables a bypass of the Script Security sandbox for users with SCM comm CVE-2017-26513.7jenkins-mailer-plugin before version 1.20 is vulnerable to an information disclosure while using the feature to send emails to a dynamically CVE-2017-26528.8It was found that there were no permission checks performed in the Distributed Fork plugin before and including 1.5.0 for Jenkins that provi