CVEvulnerability
CVE-2016-1000030
9.8 CRITICAL
Official page ↗
- Status
- Modified
- Published
- 2018-09-05
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.0 ([email protected])
- 9.8 CRITICAL — CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- CVSS 2.0 ([email protected])
- 7.5 HIGH — AV:N/AC:L/Au:N/C:P/I:P/A:P
- Weaknesses
- CWE-295
Description
Pidgin version <2.11.0 contains a vulnerability in X.509 Certificates imports specifically due to improper check of return values from gnutls_x509_crt_init() and gnutls_x509_crt_import() that can result in code execution. This attack appear to be exploitable via custom X.509 certificate from another client. This vulnerability appears to have been fixed in 2.11.0.
Affected configurations
• suse linux enterprise server 11
• pidgin pidgin (< 2.11.0)
Related
Weakness · CWE (1)
- CWE-295 Improper Certificate Validation weakness
References
- https://access.redhat.com/security/cve/cve-2016-1000030 Third Party Advisory
- https://bitbucket.org/pidgin/main/commits/d6fc1ce76ffe Patch, Third Party Advisory
- https://pidgin.im/news/security/?id=91 Vendor Advisory
- https://security.gentoo.org/glsa/201701-38 Third Party Advisory
- https://www.suse.com/pt-br/security/cve/CVE-2016-1000030/ Third Party Advisory
- https://access.redhat.com/security/cve/cve-2016-1000030 Third Party Advisory
- https://bitbucket.org/pidgin/main/commits/d6fc1ce76ffe Patch, Third Party Advisory
- https://pidgin.im/news/security/?id=91 Vendor Advisory
- https://security.gentoo.org/glsa/201701-38 Third Party Advisory
- https://www.suse.com/pt-br/security/cve/CVE-2016-1000030/ Third Party Advisory