Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
5.9

Pidgin can crash when receiving malformed MXIT messages

CVE-2016-2365 · published 9 years ago
Summary

The Pidgin chat program may stop working if it receives specially crafted MXIT data from a server or an attacker who intercepts traffic. This could cause the application to close unexpectedly, disrupting communication. Apply the latest Pidgin updates or patches to fix the issue and avoid using untrusted MXIT servers.

What to do
  • Update debian pidgin to version 2.11.0-1.
Affected software
Ecosystem VendorProductAffected versions
Debian:12 debian pidgin < 2.11.0-1
Fix: upgrade to 2.11.0-1
Debian:13 debian pidgin < 2.11.0-1
Fix: upgrade to 2.11.0-1
Debian:14 debian pidgin < 2.11.0-1
Fix: upgrade to 2.11.0-1
– pidgin pidgin <= 2.10.12
cpe:2.3:a:pidgin:pidgin:*:*:*:*:*:*:*:*
– canonical ubuntu_linux 12.04
14.04
15.10
cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:lts:*:*:*
– debian debian_linux 8.0
cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*
Original advisory text
A denial of service vulnerability exists in the handling of the MXIT protocol in Pidgin. Specially crafted MXIT data sent via the server could potentially result in a null pointer dereference. A ma...
A denial of service vulnerability exists in the handling of the MXIT protocol in Pidgin. Specially crafted MXIT data sent via the server could potentially result in a null pointer dereference. A malicious server or an attacker who intercepts the network traffic can send invalid data to trigger this vulnerability and cause a crash.
References
Severity
5.9 Medium
Exploitation
2% chance of attack within 30 days
Type
CWE-476NULL Pointer Dereference
Timeline
Published6 Jan 2017
Updated29 Oct 2026
First seen22 Sep 2026
Sources
DEBIAN-CVE-2016-2365 · OSV
CVE-2016-2365 · NVD
Track software like this
Free during beta