CVE-2016-2377
HighSummary
A buffer overflow vulnerability exists in the handling of the MXIT protocol in Pidgin. Specially crafted MXIT data sent by the server could lead to an out-of-bounds write.
Risk Assessment
A malicious server can send a negative content-length in response to an HTTP request, potentially leading to unauthorized access or application crashes.
Recommendation
It is recommended to update Pidgin to the latest version to mitigate this vulnerability and to monitor network traffic for potential attacks.
Other vulnerabilities in Pidgin
See all- CVE-2016-2378High
A buffer overflow vulnerability exists in the handling of the MXIT protocol in Pidgin. Specially crafted data sent via the server could lead to a buffer overflow, potentially resulting in memory corruption.
- CVE-2016-2376High
A buffer overflow vulnerability exists in the handling of the MXIT protocol in Pidgin. Specially crafted MXIT data sent from the server could potentially result in arbitrary code execution.
- CVE-2016-2374High
A memory corruption vulnerability exists in Pidgin's handling of the MXIT protocol. A specially crafted MXIT MultiMX message sent via the server can lead to an out-of-bounds write, resulting in memory disclosure and code execution.
- CVE-2016-2371High
An out-of-bounds write vulnerability exists in the handling of the MXIT protocol in Pidgin. Specially crafted MXIT data sent via the server could cause memory corruption resulting in code execution.
- CVE-2016-2368High
Multiple memory corruption vulnerabilities exist in the handling of the MXIT protocol in Pidgin. Specially crafted MXIT data sent via the server could result in multiple buffer overflows, potentially resulting in code execution or memory disclosure.
Original NVD description (English source)
A buffer overflow vulnerability exists in the handling of the MXIT protocol in Pidgin. Specially crafted MXIT data sent by the server could potentially result in an out-of-bounds write of one byte. A malicious server can send a negative content-length in response to a HTTP request triggering the vulnerability.