PT-2016-4495 · Pidgin+1 · Pidgin+1

Published 2016-06-21 · Updated 2018-11-14 · CVE-2016-1000030

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Pidgin versions prior to 2.11.0

Description The issue is related to improper checks of return values from gnutls x509 crt init() and gnutls x509 crt import() functions when importing X.509 certificates, potentially leading to code execution. This can be exploited via a custom X.509 certificate from another client.

Recommendations For versions prior to 2.11.0, update to version 2.11.0 to resolve the issue. As a temporary workaround, consider restricting the import of X.509 certificates from untrusted sources until the update is applied.

Fix

Improper Certificate Validation

Weakness Enumeration

CWE-295

Related Identifiers

ALT-PU-2016-1727

CVE-2016-1000030

Affected Products

Alt Linux

Pidgin

References · 9

• https://security-tracker.debian.org/tracker/CVE-2016-1000030 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2016-1000030 · Vendor Advisory
• https://bitbucket.org/pidgin/main/commits/d6fc1ce76ffe · Patch
• https://pidgin.im/news/security/?id=91 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2016-1000030 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2016-1000030 · Vendor Advisory
• https://security.gentoo.org/glsa/201701-38 · Vendor Advisory
• https://access.redhat.com/security/cve/cve-2016-1000030 · Note
• https://suse.com/pt-br/security/cve/CVE-2016-1000030 · Note