Vulnerability identifier: #VU33544

Vulnerability risk: High

CVSSv3.1: 8.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2017-2640

CWE-ID: CWE-787

Exploitation vector: Network

Exploit availability: No

Description

The vulnerability allows a remote non-authenticated attacker to execute arbitrary code.

An out-of-bounds write flaw was found in the way Pidgin before 2.12.0 processed XML content. A malicious remote server could potentially use this flaw to crash Pidgin or execute arbitrary code in the context of the pidgin process.

Mitigation
Install update from vendor's website.

External links
http://www.securityfocus.com/bid/96775
http://access.redhat.com/errata/RHSA-2017:1854
http://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-2640
http://security.gentoo.org/glsa/201706-10
http://www.debian.org/security/2017/dsa-3806

---

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.