PT-2016-4495 · Pidgin+1 · Pidgin+1

Publicado 2016-06-21 · Atualizado 2018-11-14 · CVE-2016-1000030

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Pidgin versions prior to 2.11.0

Description The issue is related to improper checks of return values from gnutls x509 crt init() and gnutls x509 crt import() functions when importing X.509 certificates, potentially leading to code execution. This can be exploited via a custom X.509 certificate from another client.

Recommendations For versions prior to 2.11.0, update to version 2.11.0 to resolve the issue. As a temporary workaround, consider restricting the import of X.509 certificates from untrusted sources until the update is applied.

Correção

Improper Certificate Validation

Enumeração de Fraquezas

CWE-295

Identificadores relacionados

ALT-PU-2016-1727

CVE-2016-1000030

Produtos afetados

Alt Linux

Pidgin

Referências · 9

• https://security-tracker.debian.org/tracker/CVE-2016-1000030 · Aviso do Fabricante
• https://access.redhat.com/security/cve/cve-2016-1000030 · Nota
• https://osv.dev/vulnerability/CVE-2016-1000030 · Aviso do Fabricante
• https://bitbucket.org/pidgin/main/commits/d6fc1ce76ffe · Correção
• https://pidgin.im/news/security/?id=91 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2016-1000030 · Nota de Segurança
• https://osv.dev/vulnerability/DEBIAN-CVE-2016-1000030 · Aviso do Fabricante
• https://security.gentoo.org/glsa/201701-38 · Aviso do Fabricante
• https://suse.com/pt-br/security/cve/CVE-2016-1000030 · Nota