CVE-2016-2368

Severity: high (CVSS 8.1 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 4.6% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2017-01-06 · updated 2026-06-17
Weakness: CWE-119

Description

Multiple memory corruption vulnerabilities exist in the handling of the MXIT protocol in Pidgin. Specially crafted MXIT data sent via the server could result in multiple buffer overflows, potentially resulting in code execution or memory disclosure.

Affected products

Canonical Ubuntu Linux: 12.04, 14.04, 15.10
Debian Linux: 8.0
Pidgin: through 2.10.12

References

http://www.debian.org/security/2016/dsa-3620
http://www.pidgin.im/news/security/?id=101
http://www.securityfocus.com/bid/91335
http://www.talosintelligence.com/reports/TALOS-2016-0136/
http://www.ubuntu.com/usn/USN-3031-1
https://security.gentoo.org/glsa/201701-38
http://www.debian.org/security/2016/dsa-3620
http://www.pidgin.im/news/security/?id=101
http://www.securityfocus.com/bid/91335
http://www.talosintelligence.com/reports/TALOS-2016-0136/
http://www.ubuntu.com/usn/USN-3031-1
https://security.gentoo.org/glsa/201701-38

Get alerted when CVE-2016-2368 or the next vulnerability affects your stack