CVE-2016-2377

A buffer overflow vulnerability exists in the handling of the MXIT protocol in Pidgin. Specially crafted MXIT data sent by the server could potentially result in an out-of-bounds write of one byte. A malicious server can send a negative content-length in response to a HTTP request triggering the...

CVE-2016-2378

A buffer overflow vulnerability exists in the handling of the MXIT protocol Pidgin. Specially crafted data sent via the server could potentially result in a buffer overflow, potentially resulting in memory corruption. A malicious server or an unfiltered malicious user can send negative length...

CVE-2016-2372

An information leak exists in the handling of the MXIT protocol in Pidgin. Specially crafted MXIT data sent via the server could potentially result in an out-of-bounds read. A malicious user, server, or man-in-the-middle attacker can send an invalid size for a file transfer which will trigger an...

CVE-2016-2373

A denial of service vulnerability exists in the handling of the MXIT protocol in Pidgin. Specially crafted MXIT data sent via the server could potentially result in an out-of-bounds read. A malicious server or user can send an invalid mood to trigger this vulnerability...

CVE-2016-4323

A directory traversal exists in the handling of the MXIT protocol in Pidgin. Specially crafted MXIT data sent from the server could potentially result in an overwrite of files. A malicious server or someone with access to the network traffic can provide an invalid filename for a splash image...

CVE-2016-2369

A NULL pointer dereference vulnerability exists in the handling of the MXIT protocol in Pidgin. Specially crafted MXIT data sent via the server could potentially result in a denial of service vulnerability. A malicious server can send a packet starting with a NULL byte triggering the vulnerabilit...

CVE-2016-2365

A denial of service vulnerability exists in the handling of the MXIT protocol in Pidgin. Specially crafted MXIT data sent via the server could potentially result in a null pointer dereference. A malicious server or an attacker who intercepts the network traffic can send invalid data to trigger th...

CVE-2016-2368

CVE-2016-2368 involves multiple memory corruption vulnerabilities in Pidgin’s MXIT protocol handling. Specially crafted MXIT data could cause buffer overflows, potentially enabling code execution or memory disclosure. Connected sources consistently tie this to Pidgin (MXIT) and note exploitation ...

CVE-2016-2375

CVE-2016-2375 affects Pidgin via an out-of-bounds read in MXIT handling that can disclose memory contents. The connected references confirm this CVE is tied to Pidgin’s MXIT processing and memory disclosure. No specific patch version or remediation details are provided in the supplied documents; ...

CVE-2016-2373

CVE-2016-2373 affects the Pidgin MXIT protocol handling. Across connected sources, a malicious server or user can send specially crafted MXIT data (e.g., invalid mood) that can trigger a crash through a null pointer dereference or an out-of-bounds read/write in the MXIT processing, depending on t...

CVE-2016-2380

CVE-2016-2380 affects Pidgin via an information leak in MXIT protocol handling. Specially crafted MXIT data could trigger an out-of-bounds read when a user enters a string that is mis-converted, per multiple connected advisories (e.g., Nessus/Red Hat EulerOS entries). The vulnerability is limited...

CVE-2016-2374

The CVE-2016-2374 entry affects Pidgin's MXIT protocol handling. The vulnerability is an exploitable memory corruption in the MXIT MultiMX message handling, where specially crafted server messages can trigger an out-of-bounds write, leading to memory disclosure and potential code execution. Affec...

GLSA-201701-10 : libotr, Pidgin OTR: Remote execution of arbitrary code

The remote host is affected by the vulnerability described in GLSA-201701-10 libotr, Pidgin OTR: Remote execution of arbitrary code Multiple vulnerabilities exist in both libotr and Pidgin OTR. Please review the CVE identifiers for more information. Impact : A remote attacker could send a special...

libotr, Pidgin OTR: Remote execution of arbitrary code

Background Pidgin Off-the-Record OTR messaging allows you to have private conversations over instant messaging. libotr is a portable off-the-record messaging library. Description Multiple vulnerabilities exist in both libotr and Pidgin OTR. Please review the CVE identifiers for more information...

SUSE-SU-2016:2416-1 Security update for pidgin

This update for pidgin fixes the following issues: Security issues fixed: - CVE-2016-2367: Fixed a MXIT Avatar Length Memory Disclosure Vulnerability bsc991715. - CVE-2016-2370: Fixed a MXIT Custom Resource Denial of Service Vulnerability bsc991712. - CVE-2016-2371: Fixed a MXIT Extended Profiles...

Slackware 13.0 / 13.1 / 13.37 / 14.0 / 14.1 : pidgin (SSA:2016-266-02)

New pidgin packages are available for Slackware 13.0, 13.1, 13.37, 14.0, and 14.1 to fix security issues. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from Slackware Security Advisory 2016-266-02. The text itself is...

[slackware-security] pidgin

New pidgin packages are available for Slackware 13.0, 13.1, 13.37, 14.0, and 14.1 to fix security issues. Here are the details from the Slackware 14.1 ChangeLog: patches/packages/pidgin-2.11.0-i486-1slack14.1.txz: Upgraded. NOTE: These packages provide updates to pidgin-2.11.0, since the previous...

Slackware 13.0 / 13.1 / 13.37 / 14.0 / 14.1 / 14.2 / current : pidgin (SSA:2016-265-01)

New pidgin packages are available for Slackware 13.0, 13.1, 13.37, 14.0, 14.1, 14.2, and -current to fix security issues. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from Slackware Security Advisory 2016-265-01. The te...

[slackware-security] pidgin

New pidgin packages are available for Slackware 13.0, 13.1, 13.37, 14.0, 14.1, 14.2, and -current to fix security issues. Here are the details from the Slackware 14.2 ChangeLog: patches/packages/pidgin-2.11.0-i586-1slack14.2.txz: Upgraded. This release fixes bugs and security issues. For more...

CVE-2016-1000030

Pidgin version 2.11.0 contains a vulnerability in X.509 Certificates imports specifically due to improper check of return values from gnutlsx509crtinit and gnutlsx509crtimport that can result in code execution. This attack appear to be exploitable via custom X.509 certificate from another client...