Description
Multiple serious vulnerabilities have been found in Pidgin. Malicious users can exploit these vulnerabilities to overwrite arbitrary files, cause denial of service, obtain sensitive information.
Below is a complete list of vulnerabilities:
- A directory traversal vulnerability in the handling of MXIT protocol can be exploited remotely via specially designed MXIT data sent from the server to overwrite arbitrary files;
- An out-of-bounds read vulnerability can be exploited remotely via specialy designed MXIT data (a particular string) possibly to obtain sensitive information;
- A buffer overflow vulnerability in the handling of MXIT protocol can be exploited remotely via specially designed data possibly to cause a denial of service.
Technical details
Vulnerability (1) occurs if liburple is triggered by man-in-the-middle or a malicious server to overwrite local files. The name and and content of these files can be specified by the remote attacker.
To trigger vulnerability (3) a malicious server or man-in-the-middle can send negative length values.
Original advisories
Related products
CVE list
- CVE-2016-2380 warning
- CVE-2016-2378 high
- CVE-2016-4323 high
Read more
Find out the statistics of the vulnerabilities spreading in your region on statistics.securelist.com
Found an inaccuracy in the description of this vulnerability? Let us know!