CVE-2016-2380: Canonical Ubuntu Linux

Low severity, CVSS 3.1. EPSS: 1.7% chance of exploitation in the next 30 days.

An information leak exists in the handling of the MXIT protocol in Pidgin. Specially crafted MXIT data sent to the server could potentially result in an out-of-bounds read. A user could be convinced to enter a particular string which would then get converted incorrectly and could lead to a potential out-of-bounds read.

Affected products

• Canonical Ubuntu Linux: version 12.04 only; version 14.04 only; version 15.10 only
• Debian Debian Linux: version 8.0 only
• Pidgin Pidgin: up to and including 2.10.12

Published 2017-01-06. Last modified 2026-06-17.