A vulnerability, which was classified as problematic, was found in Pidgin up to 2.10.x (Messaging Software). This affects an unknown part of the component MXIT File Transfer. The manipulation with an unknown input leads to a information disclosure vulnerability (Memory). CWE is classifying the issue as CWE-200. The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. This is going to have an impact on confidentiality.

The weakness was disclosed 06/21/2016 by Yves Younan with Cisco Talos as not defined advisory (Website). The advisory is shared at pidgin.im. This vulnerability is uniquely identified as CVE-2016-2372 since 02/12/2016. Neither technical details nor an exploit are publicly available. MITRE ATT&CK project uses the attack technique T1592 for this issue.

The commercial vulnerability scanner Qualys is able to test this issue with plugin 169228 (SUSE Enterprise Linux Security Update for pidgin (SUSE-SU-2016:2416-1)).

Upgrading to version 2.11.0 eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at SecurityFocus (BID 91335†). The entries VDB-91844, VDB-91845, VDB-91846 and VDB-91847 are pretty similar.

Productinfo

Type

• Messaging Software

Name

• Pidgin

Version

• 2.0
• 2.1
• 2.2
• 2.3
• 2.4
• 2.5
• 2.6
• 2.7
• 2.8
• 2.9
• 2.10

License

• open-source

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Discussion