CVSS: 8.1EPSS: 0%CPEs: 5EXPL: 0CVE-2016-2376
https://notcve.org/view.php?id=CVE-2016-2376
A buffer overflow vulnerability exists in the handling of the MXIT protocol in Pidgin. Specially crafted MXIT data sent from the server could potentially result in arbitrary code execution. A malicious server or an attacker who intercepts the network traffic can send an invalid size for a packet which will trigger a buffer overflow. Existe una vulnerabilidad de desbordamiento de búfer en el manejo del protocolo MXIT en Pidgin. Datos MXIT especialmente manipulados enviados desde el servidor podrían resultar potencialmente en ejecución de código arbitrario. • http://www.debian.org/security/2016/dsa-3620 http://www.pidgin.im/news/security/?id=92 http://www.securityfocus.com/bid/91335 http://www.talosintelligence.com/reports/TALOS-2016-0118 http://www.ubuntu.com/usn/USN-3031-1 https://security.gentoo.org/glsa/201701-38 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 8.1EPSS: 1%CPEs: 5EXPL: 0CVE-2016-2377
https://notcve.org/view.php?id=CVE-2016-2377
A buffer overflow vulnerability exists in the handling of the MXIT protocol in Pidgin. Specially crafted MXIT data sent by the server could potentially result in an out-of-bounds write of one byte. A malicious server can send a negative content-length in response to a HTTP request triggering the vulnerability. Existe una vulnerabilidad de desbordamiento de búfer en el manejo del protocolo MXIT en Pidgin. Datos MXIT especialmente manipulados enviados por el servidor podrían resultar potencialmente en una escritura fuera de límites de un byte. • http://www.debian.org/security/2016/dsa-3620 http://www.pidgin.im/news/security/?id=93 http://www.securityfocus.com/bid/91335 http://www.talosintelligence.com/reports/TALOS-2016-0119 http://www.ubuntu.com/usn/USN-3031-1 https://security.gentoo.org/glsa/201701-38 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 8.1EPSS: 0%CPEs: 5EXPL: 0CVE-2016-2378
https://notcve.org/view.php?id=CVE-2016-2378
A buffer overflow vulnerability exists in the handling of the MXIT protocol Pidgin. Specially crafted data sent via the server could potentially result in a buffer overflow, potentially resulting in memory corruption. A malicious server or an unfiltered malicious user can send negative length values to trigger this vulnerability. Existe una vulnerabilidad de desbordamiento de búfer en el manejo del protocolo MXIT en Pidgin. Datos especialmente manipulados enviados a través del servidor podrían resultar potencialmente en un desbordamiento de búfer, potencialmente resultando en corrupción de memoria. • http://www.debian.org/security/2016/dsa-3620 http://www.pidgin.im/news/security/?id=94 http://www.securityfocus.com/bid/91335 http://www.talosintelligence.com/reports/TALOS-2016-0120 http://www.ubuntu.com/usn/USN-3031-1 https://security.gentoo.org/glsa/201701-38 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 4.3EPSS: 0%CPEs: 5EXPL: 0CVE-2016-2380
https://notcve.org/view.php?id=CVE-2016-2380
An information leak exists in the handling of the MXIT protocol in Pidgin. Specially crafted MXIT data sent to the server could potentially result in an out-of-bounds read. A user could be convinced to enter a particular string which would then get converted incorrectly and could lead to a potential out-of-bounds read. Existe una fuga de información en el manejo del protocolo MXIT en Pidgin.Datos MXIT expecialmente manipulados enviados al servidor podrían resultar potencialmente en una lectura fuera de límites. Un usuario podría ser convencido para introducir una cadena particular que podría entonces ser convertida de forma incorrecta y conducir a una potencial lectura fuera de límites. • http://www.debian.org/security/2016/dsa-3620 http://www.pidgin.im/news/security/?id=96 http://www.securityfocus.com/bid/91335 http://www.talosintelligence.com/reports/TALOS-2016-0123 http://www.ubuntu.com/usn/USN-3031-1 https://security.gentoo.org/glsa/201701-38 • CWE-125: Out-of-bounds Read CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 6.4EPSS: 0%CPEs: 10EXPL: 0CVE-2014-3697
https://notcve.org/view.php?id=CVE-2014-3697
Absolute path traversal vulnerability in the untar_block function in win32/untar.c in Pidgin before 2.10.10 on Windows allows remote attackers to write to arbitrary files via a drive name in a tar archive of a smiley theme. Vulnerabilidad de salto de ruta absoluta en la función untar_block en win32/untar.c en Pidgin anterior a 2.10.10 en Windows permite a atacantes remotos escribir a ficheros arbitrarios a través de un nombre drive en un archivo tar de un tema smiley. • http://hg.pidgin.im/pidgin/main/rev/68b8eb10977f http://lists.opensuse.org/opensuse-updates/2014-11/msg00023.html http://lists.opensuse.org/opensuse-updates/2014-11/msg00037.html http://pidgin.im/news/security/?id=89 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •