According to the versions of the pidgin package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - A buffer overflow vulnerability exists in the handling     of the MXIT protocol in Pidgin. Specially crafted MXIT     data sent by the server could potentially result in an     out-of-bounds write of one byte. A malicious server can     send a negative content-length in response to a HTTP     request triggering the vulnerability.(CVE-2016-2377)

  - A buffer overflow vulnerability exists in the handling     of the MXIT protocol in Pidgin. Specially crafted MXIT     data sent from the server could potentially result in     arbitrary code execution. A malicious server or an     attacker who intercepts the network traffic can send an     invalid size for a packet which will trigger a buffer     overflow.(CVE-2016-2376)

  - A buffer overflow vulnerability exists in the handling     of the MXIT protocol Pidgin. Specially crafted data     sent via the server could potentially result in a     buffer overflow, potentially resulting in memory     corruption. A malicious server or an unfiltered     malicious user can send negative length values to     trigger this vulnerability.(CVE-2016-2378)

  - A denial of service vulnerability exists in the     handling of the MXIT protocol in Pidgin. Specially     crafted MXIT data sent from the server could     potentially result in an out-of-bounds read. A     malicious server or man-in-the-middle attacker can send     invalid data to trigger this     vulnerability.(CVE-2016-2370)

  - A denial of service vulnerability exists in the     handling of the MXIT protocol in Pidgin. Specially     crafted MXIT data sent via the server could potentially     result in a null pointer dereference. A malicious     server or an attacker who intercepts the network     traffic can send invalid data to trigger this     vulnerability and cause a crash.(CVE-2016-2365)

  - A denial of service vulnerability exists in the     handling of the MXIT protocol in Pidgin. Specially     crafted MXIT data sent via the server could potentially     result in an out-of-bounds read. A malicious server or     an attacker who intercepts the network traffic can send     invalid data to trigger this vulnerability and cause a     crash.(CVE-2016-2366)

  - A denial of service vulnerability exists in the     handling of the MXIT protocol in Pidgin. Specially     crafted MXIT data sent via the server could potentially     result in an out-of-bounds read. A malicious server or     user can send an invalid mood to trigger this     vulnerability.(CVE-2016-2373)

  - A directory traversal exists in the handling of the     MXIT protocol in Pidgin. Specially crafted MXIT data     sent from the server could potentially result in an     overwrite of files. A malicious server or someone with     access to the network traffic can provide an invalid     filename for a splash image triggering the     vulnerability.(CVE-2016-4323)

  - A NULL pointer dereference vulnerability exists in the     handling of the MXIT protocol in Pidgin. Specially     crafted MXIT data sent via the server could potentially     result in a denial of service vulnerability. A     malicious server can send a packet starting with a NULL     byte triggering the vulnerability.(CVE-2016-2369)

  - An exploitable memory corruption vulnerability exists     in the handling of the MXIT protocol in Pidgin.
    Specially crafted MXIT MultiMX message sent via the     server can result in an out-of-bounds write leading to     memory disclosure and code execution.(CVE-2016-2374)

  - An exploitable out-of-bounds read exists in the     handling of the MXIT protocol in Pidgin. Specially     crafted MXIT contact information sent from the server     can result in memory disclosure.(CVE-2016-2375)

  - An information leak exists in the handling of the MXIT     protocol in Pidgin. Specially crafted MXIT data sent to     the server could potentially result in an out-of-bounds     read. A user could be convinced to enter a particular     string which would then get converted incorrectly and     could lead to a potential out-of-bounds     read.(CVE-2016-2380)

  - An information leak exists in the handling of the MXIT     protocol in Pidgin. Specially crafted MXIT data sent     via the server could potentially result in an     out-of-bounds read. A malicious user, server, or     man-in-the-middle attacker can send an invalid size for     a file transfer which will trigger an out-of-bounds     read vulnerability. This could result in a denial of     service or copy data from memory to the file, resulting     in an information leak if the file is sent to another     user.(CVE-2016-2372)

  - An information leak exists in the handling of the MXIT     protocol in Pidgin. Specially crafted MXIT data sent     via the server could potentially result in an     out-of-bounds read. A malicious user, server, or     man-in-the-middle can send an invalid size for an     avatar which will trigger an out-of-bounds read     vulnerability. This could result in a denial of service     or copy data from memory to the file, resulting in an     information leak if the avatar is sent to another     user.(CVE-2016-2367)

  - An out-of-bounds write vulnerability exists in the     handling of the MXIT protocol in Pidgin. Specially     crafted MXIT data sent via the server could cause     memory corruption resulting in code     execution.(CVE-2016-2371)

  - Multiple memory corruption vulnerabilities exist in the     handling of the MXIT protocol in Pidgin. Specially     crafted MXIT data sent via the server could result in     multiple buffer overflows, potentially resulting in     code execution or memory disclosure.(CVE-2016-2368)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Detections

Analytics

EulerOS 2.0 SP3 : pidgin (EulerOS-SA-2019-2650)

high Nessus Plugin ID 132185

Version 1.8