Out-of-bounds write - CVE-2017-2640
Published: July 27, 2018 / Updated: August 4, 2020
Vulnerability identifier: #VU33544
CSH Severity: High
CVSS v4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2017-2640
CWE-ID: CWE-787
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote non-authenticated attacker to execute arbitrary code.
An out-of-bounds write flaw was found in the way Pidgin before 2.12.0 processed XML content. A malicious remote server could potentially use this flaw to crash Pidgin or execute arbitrary code in the context of the pidgin process.
Affected software
Arch Linux
Gentoo Linux
Slackware Linux
Opensuse
pidgin (Alpine package)
Gentoo Linux
Slackware Linux
Opensuse
pidgin (Alpine package)
How to mitigate CVE-2017-2640
Install update from vendor's website.
pidgin (Alpine package) - update to 2.10.11-r1