TI-2017-01890 CVE-2017-2640 · GHSA-556c-qpr9-626c
Out-of-bounds write in pidgin
Priority MEDIUM 51
An out-of-bounds write flaw was found in the way Pidgin before 2.12.0 processed XML content.
RHSA-2017:1854
pidgin security, bug fix, and enhancement update
Released 2017-08-01 · Red Hat rating Moderate · View on Red Hat →
Fixed in
- Red Hat Enterprise Linux Client (v. 7) libpurple-2.10.11-5.el7, pidgin-2.10.11-5.el7
- Red Hat Enterprise Linux Client Optional (v. 7) finch-2.10.11-5.el7, finch-devel-2.10.11-5.el7, libpurple-devel-2.10.11-5.el7 +4
- Red Hat Enterprise Linux Server (v. 7) libpurple-2.10.11-5.el7, libpurple-2.10.11-5.el7.ppc, pidgin-2.10.11-5.el7
- Red Hat Enterprise Linux Server Optional (v. 7) finch-2.10.11-5.el7, finch-2.10.11-5.el7.ppc, finch-devel-2.10.11-5.el7 +9
- Red Hat Enterprise Linux Workstation (v. 7) libpurple-2.10.11-5.el7, pidgin-2.10.11-5.el7
- Red Hat Enterprise Linux Workstation Optional (v. 7) finch-2.10.11-5.el7, finch-devel-2.10.11-5.el7, libpurple-devel-2.10.11-5.el7 +4
Fixes 5 records
TI-2014-03010 CVE-2014-3694 · GHSA-qfvv-4jjj-6cq2
The (1) bundled GnuTLS SSL/TLS plugin and the (2) bundled OpenSSL SSL/TLS plugin in…
Priority LOW 33
The (1) bundled GnuTLS SSL/TLS plugin and the (2) bundled OpenSSL SSL/TLS plugin in libpurple in Pidgin before 2.10.10 do not properly consider the Basic Constraints extension during verification of X.509 certificates fr…
TI-2014-03014 CVE-2014-3698 · GHSA-q7w8-7jp2-2p9v
The jabber_idn_validate function in jutil.c in the Jabber protocol plugin in libpurple in…
Priority LOW 29
The jabber_idn_validate function in jutil.c in the Jabber protocol plugin in libpurple in Pidgin before 2.10.10 allows remote attackers to obtain sensitive information from process memory via a crafted XMPP message.
TI-2014-03012 CVE-2014-3696 · GHSA-96p5-rvrv-9x22
nmevent.c in the Novell GroupWise protocol plugin in libpurple in Pidgin before 2.10.10…
Priority LOW 28
nmevent.c in the Novell GroupWise protocol plugin in libpurple in Pidgin before 2.10.10 allows remote servers to cause a denial of service (application crash) via a crafted server message that triggers a large memory all…
TI-2014-03011 CVE-2014-3695 · GHSA-5p8v-243c-373h
markup.c in the MXit protocol plugin in libpurple in Pidgin before 2.10.10 allows remote…
Priority LOW 28
markup.c in the MXit protocol plugin in libpurple in Pidgin before 2.10.10 allows remote servers to cause a denial of service (application crash) via a large length value in an emoticon response.