CVE-2016-1000030 Pidgin version <2.11.0 contains a vulnerability in X.509 Certificates imports specifically due to improper check of return values from gnutls_x509_crt_init() and gnutls_x509_crt_import() that can resu...
CriticalCVSS 9.8
EPSS 1.8%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Pidgin version <2.11.0 contains a vulnerability in X.509 Certificates imports specifically due to improper check of return values from gnutls_x509_crt_init() and gnutls_x509_crt_import() that can result in code execution. This attack appear to be exploitable via custom X.509 certificate from another client. This vulnerability appears to have been fixed in 2.11.0.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/pidgin(Debian:12) | < 2.11.0-1 | 2.11.0-1 |
| debian/pidgin(Debian:13) | < 2.11.0-1 | 2.11.0-1 |
| debian/pidgin(Debian:14) | < 2.11.0-1 | 2.11.0-1 |
| SUSE linux enterprise server | = 11-sp4 | No fix listed |
| pidgin | < 2.11.0 | 2.11.0 |
References
- Debian Security Tracker CVE-2016-1000030 vendor-advisory
- access.redhat.com third-party-advisory
- bitbucket.org patch third-party-advisory
- pidgin.im vendor-advisory
- GLSA-201701-38 third-party-advisory vendor-advisory
- www.suse.com third-party-advisory