CVE-2016-2365

Publication date 23 June 2016

Last updated 25 August 2025

Ubuntu priority

Cvss 3 Severity Score

Description

A denial of service vulnerability exists in the handling of the MXIT protocol in Pidgin. Specially crafted MXIT data sent via the server could potentially result in a null pointer dereference. A malicious server or an attacker who intercepts the network traffic can send invalid data to trigger this vulnerability and cause a crash.

Read the notes from the security team

Status

Show unmaintained releases

Package	Ubuntu Release	Status
pidgin	16.04 LTS xenial	Fixed 1:2.10.12-0ubuntu5.1
	15.10 wily	Fixed 1:2.10.11-0ubuntu4.2
	14.04 LTS trusty	Fixed 1:2.10.9-0ubuntu3.3
	12.04 LTS precise	Fixed 1:2.10.3-0ubuntu1.7

Notes

seth-arnold

I'm skeptical the fix addresses all issues raised

mdeslaur

commit in upstream advisory is wrong, it is actually the commit for CVE-2016-4323

Patch details

For informational purposes only. We recommend not to cherry-pick updates. How can I get the fixes?

Package	Patch details
pidgin	Upstream: https://bitbucket.org/pidgin/main/commits/1c4acc6977a8686ad980e5b820327c9c47dbeaca

Severity score breakdown

CVSS version: CVSS v3.0

Base score 5.9 · Medium

Base metrics

Parameter	Value
Attack vector	Network
Attack complexity	High
Privileges required	None
User interaction	None
Scope	Unchanged
Confidentiality impact	None
Integrity impact	None
Availability impact	High

Scores

Parameter	Value
Base score	5.9 · Medium
Exploitability score	-
Impact score	-