CVE-2016-1000030

EUVD-2016-1037
Pidgin version <2.11.0 contains a vulnerability in X.509 Certificates imports specifically due to improper check of return values from gnutls_x509_crt_init() and gnutls_x509_crt_import() that can result in code execution. This attack appear to be exploitable via custom X.509 certificate from another client. This vulnerability appears to have been fixed in 2.11.0.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
9.8 CRITICAL
NETWORK
LOW
NONE
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: 73%
Affected Products (NVD)
VendorProductVersion
pidginpidgin
𝑥
< 2.11.0
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
pidgin
bookworm
2.14.12-1
fixed
bullseye
2.14.1-1
fixed
sid
2.14.13-2
fixed
trixie
2.14.13-2
fixed
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
pidgin
precise
not-affected
trusty
not-affected
wily
not-affected
xenial
not-affected
Common Weakness Enumeration
References
https://access.redhat.com/security/cve/cve-2016-1000030
https://bitbucket.org/pidgin/main/commits/d6fc1ce76ffe
https://pidgin.im/news/security/?id=91
https://security.gentoo.org/glsa/201701-38
https://www.suse.com/pt-br/security/cve/CVE-2016-1000030/
https://access.redhat.com/security/cve/cve-2016-1000030
https://bitbucket.org/pidgin/main/commits/d6fc1ce76ffe
https://pidgin.im/news/security/?id=91
https://security.gentoo.org/glsa/201701-38
https://www.suse.com/pt-br/security/cve/CVE-2016-1000030/