Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
92 results · page 1 of 2
Mar 21, 2026Pidgin 2.13.0 contains a denial of service vulnerability that allows local attackers to crash the application by providing an excessively long username string dCVE-2019-25544 · Other software · Pidgin · reported by VulnCheckMedium 6.9
Pidgin 2.13.0 contains a denial of service vulnerability that allows local attackers to crash the application by providing an excessively long username string during account creation. Attackers can input a buffer of 1000 characters in the username field and trigger a crash when joining a chat, causing the application to become unavailable.
- Product
- Pidgin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpidgin.imexploit-db.com
Jun 2, 2022An issue was discovered in Pidgin before 2.14.9.CVE-2022-26491 · Other software · Pidgin · reported by MITREMedium 5.9
An issue was discovered in Pidgin before 2.14.9. A remote attacker who can spoof DNS responses can redirect a client connection to a malicious server. The client will perform TLS certificate verification of the malicious domain name instead of the original XMPP service domain, allowing the attacker to take over control over the XMPP connection and to obtain user credentials and all communication content. This is similar to CVE-2022-24968.
- Product
- Pidgin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddeveloper.pidgin.imgithub.com
Nov 20, 2019Pidgin 2.10.0 uses DBUS for certain cleartext communication, which allows local users to obtain sensitive information via a dbus session monitor.CVE-2012-1257 · Other software · Pidgin · reported by MITREMedium 5.5
Pidgin 2.10.0 uses DBUS for certain cleartext communication, which allows local users to obtain sensitive information via a dbus session monitor.
- Product
- Pidgin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddeveloper.pidgin.impidgin.im
Sep 5, 2018Pidgin version <2.11.0 contains a vulnerability in X.509 Certificates imports specifically due to improper check of return values from gnutls_x509_crt_init() anCVE-2016-1000030 · Other software · Suse · reported by MITRECritical 9.8
Pidgin version <2.11.0 contains a vulnerability in X.509 Certificates imports specifically due to improper check of return values from gnutls_x509_crt_init() and gnutls_x509_crt_import() that can result in code execution. This attack appear to be exploitable via custom X.509 certificate from another client. This vulnerability appears to have been fixed in 2.11.0.
- Product
- Linux Enterprise Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaccess.redhat.combitbucket.org
Jul 27, 2018An out-of-bounds write flaw was found in the way Pidgin before 2.12.0 processed XML content.CVE-2017-2640 · Other software · Pidgin · reported by Red HatHigh 7.5
An out-of-bounds write flaw was found in the way Pidgin before 2.12.0 processed XML content. A malicious remote server could potentially use this flaw to crash Pidgin or execute arbitrary code in the context of the pidgin process.
- Product
- pidgin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comaccess.redhat.com
Mar 29, 2017The Mxit protocol uses weak encryption when encrypting user passwords, which might allow attackers to (1) decrypt hashed passwords by leveraging knowledge of clCVE-2016-2379 · Other software · Pidgin · reported by cret@cert.orgHigh 8.8
The Mxit protocol uses weak encryption when encrypting user passwords, which might allow attackers to (1) decrypt hashed passwords by leveraging knowledge of client registration codes or (2) gain login access by eavesdropping on login messages and re-using the hashed passwords.
- Product
- Mxit
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comtalosintelligence.com
Jan 6, 2017A directory traversal exists in the handling of the MXIT protocol in Pidgin.CVE-2016-4323 · Other software · Pidgin · reported by cret@cert.orgLow 3.7
A directory traversal exists in the handling of the MXIT protocol in Pidgin. Specially crafted MXIT data sent from the server could potentially result in an overwrite of files. A malicious server or someone with access to the network traffic can provide an invalid filename for a splash image triggering the vulnerability.
- Product
- Pidgin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 6, 2017An information leak exists in the handling of the MXIT protocol in Pidgin.CVE-2016-2380 · Other software · Pidgin · reported by cret@cert.orgLow 3.1
An information leak exists in the handling of the MXIT protocol in Pidgin. Specially crafted MXIT data sent to the server could potentially result in an out-of-bounds read. A user could be convinced to enter a particular string which would then get converted incorrectly and could lead to a potential out-of-bounds read.
- Product
- Pidgin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 6, 2017A buffer overflow vulnerability exists in the handling of the MXIT protocol Pidgin.CVE-2016-2378 · Other software · Pidgin · reported by cret@cert.orgHigh 8.1
A buffer overflow vulnerability exists in the handling of the MXIT protocol Pidgin. Specially crafted data sent via the server could potentially result in a buffer overflow, potentially resulting in memory corruption. A malicious server or an unfiltered malicious user can send negative length values to trigger this vulnerability.
- Product
- Pidgin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 6, 2017A buffer overflow vulnerability exists in the handling of the MXIT protocol in Pidgin.CVE-2016-2377 · Other software · Pidgin · reported by cret@cert.orgHigh 8.1
A buffer overflow vulnerability exists in the handling of the MXIT protocol in Pidgin. Specially crafted MXIT data sent by the server could potentially result in an out-of-bounds write of one byte. A malicious server can send a negative content-length in response to a HTTP request triggering the vulnerability.
- Product
- Pidgin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 6, 2017A buffer overflow vulnerability exists in the handling of the MXIT protocol in Pidgin.CVE-2016-2376 · Other software · Pidgin · reported by cret@cert.orgHigh 8.1
A buffer overflow vulnerability exists in the handling of the MXIT protocol in Pidgin. Specially crafted MXIT data sent from the server could potentially result in arbitrary code execution. A malicious server or an attacker who intercepts the network traffic can send an invalid size for a packet which will trigger a buffer overflow.
- Product
- Pidgin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 6, 2017An exploitable out-of-bounds read exists in the handling of the MXIT protocol in Pidgin.CVE-2016-2375 · Other software · Pidgin · reported by cret@cert.orgMedium 5.3
An exploitable out-of-bounds read exists in the handling of the MXIT protocol in Pidgin. Specially crafted MXIT contact information sent from the server can result in memory disclosure.
- Product
- Pidgin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 6, 2017An exploitable memory corruption vulnerability exists in the handling of the MXIT protocol in Pidgin.CVE-2016-2374 · Other software · Pidgin · reported by cret@cert.orgHigh 8.1
An exploitable memory corruption vulnerability exists in the handling of the MXIT protocol in Pidgin. Specially crafted MXIT MultiMX message sent via the server can result in an out-of-bounds write leading to memory disclosure and code execution.
- Product
- Pidgin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 6, 2017A denial of service vulnerability exists in the handling of the MXIT protocol in Pidgin.CVE-2016-2373 · Other software · Pidgin · reported by cret@cert.orgMedium 5.9
A denial of service vulnerability exists in the handling of the MXIT protocol in Pidgin. Specially crafted MXIT data sent via the server could potentially result in an out-of-bounds read. A malicious server or user can send an invalid mood to trigger this vulnerability.
- Product
- Pidgin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 6, 2017An information leak exists in the handling of the MXIT protocol in Pidgin.CVE-2016-2372 · Other software · Pidgin · reported by cret@cert.orgMedium 5.9
An information leak exists in the handling of the MXIT protocol in Pidgin. Specially crafted MXIT data sent via the server could potentially result in an out-of-bounds read. A malicious user, server, or man-in-the-middle attacker can send an invalid size for a file transfer which will trigger an out-of-bounds read vulnerability. This could result in a denial of service or copy data from memory to the file, resulting in an information leak if the file is sent to another user.
- Product
- Pidgin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 6, 2017An out-of-bounds write vulnerability exists in the handling of the MXIT protocol in Pidgin.CVE-2016-2371 · Other software · Pidgin · reported by cret@cert.orgHigh 8.1
An out-of-bounds write vulnerability exists in the handling of the MXIT protocol in Pidgin. Specially crafted MXIT data sent via the server could cause memory corruption resulting in code execution.
- Product
- Pidgin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 6, 2017A denial of service vulnerability exists in the handling of the MXIT protocol in Pidgin.CVE-2016-2370 · Other software · Pidgin · reported by cret@cert.orgMedium 5.9
A denial of service vulnerability exists in the handling of the MXIT protocol in Pidgin. Specially crafted MXIT data sent from the server could potentially result in an out-of-bounds read. A malicious server or man-in-the-middle attacker can send invalid data to trigger this vulnerability.
- Product
- Pidgin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 6, 2017A NULL pointer dereference vulnerability exists in the handling of the MXIT protocol in Pidgin.CVE-2016-2369 · Other software · Pidgin · reported by cret@cert.orgMedium 5.9
A NULL pointer dereference vulnerability exists in the handling of the MXIT protocol in Pidgin. Specially crafted MXIT data sent via the server could potentially result in a denial of service vulnerability. A malicious server can send a packet starting with a NULL byte triggering the vulnerability.
- Product
- Pidgin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 6, 2017Multiple memory corruption vulnerabilities exist in the handling of the MXIT protocol in Pidgin.CVE-2016-2368 · Other software · Pidgin · reported by cret@cert.orgHigh 8.1
Multiple memory corruption vulnerabilities exist in the handling of the MXIT protocol in Pidgin. Specially crafted MXIT data sent via the server could result in multiple buffer overflows, potentially resulting in code execution or memory disclosure.
- Product
- Pidgin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 6, 2017An information leak exists in the handling of the MXIT protocol in Pidgin.CVE-2016-2367 · Other software · Pidgin · reported by cret@cert.orgMedium 5.9
An information leak exists in the handling of the MXIT protocol in Pidgin. Specially crafted MXIT data sent via the server could potentially result in an out-of-bounds read. A malicious user, server, or man-in-the-middle can send an invalid size for an avatar which will trigger an out-of-bounds read vulnerability. This could result in a denial of service or copy data from memory to the file, resulting in an information leak if the avatar is sent to another user.
- Product
- Pidgin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 6, 2017A denial of service vulnerability exists in the handling of the MXIT protocol in Pidgin.CVE-2016-2366 · Other software · Pidgin · reported by cret@cert.orgMedium 5.9
A denial of service vulnerability exists in the handling of the MXIT protocol in Pidgin. Specially crafted MXIT data sent via the server could potentially result in an out-of-bounds read. A malicious server or an attacker who intercepts the network traffic can send invalid data to trigger this vulnerability and cause a crash.
- Product
- Pidgin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 6, 2017A denial of service vulnerability exists in the handling of the MXIT protocol in Pidgin.CVE-2016-2365 · Other software · Pidgin · reported by cret@cert.orgMedium 5.9
A denial of service vulnerability exists in the handling of the MXIT protocol in Pidgin. Specially crafted MXIT data sent via the server could potentially result in a null pointer dereference. A malicious server or an attacker who intercepts the network traffic can send invalid data to trigger this vulnerability and cause a crash.
- Product
- Pidgin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 11, 2016Use-after-free vulnerability in the create_smp_dialog function in gtk-dialog.c in the Off-the-Record Messaging (OTR) pidgin-otr plugin before 4.0.2 for Pidgin aCVE-2015-8833 · Other software · Cypherpunks · reported by MITRECritical 9.8
Use-after-free vulnerability in the create_smp_dialog function in gtk-dialog.c in the Off-the-Record Messaging (OTR) pidgin-otr plugin before 4.0.2 for Pidgin allows remote attackers to execute arbitrary code via vectors related to the "Authenticate buddy" menu item.
- Product
- Pidgin-otr
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.opensuse.orglists.opensuse.org
Oct 29, 2014The jabber_idn_validate function in jutil.c in the Jabber protocol plugin in libpurple in Pidgin before 2.10.10 allows remote attackers to obtain sensitive infoCVE-2014-3698 · Other software · Pidgin · reported by Red HatMedium 5
The jabber_idn_validate function in jutil.c in the Jabber protocol plugin in libpurple in Pidgin before 2.10.10 allows remote attackers to obtain sensitive information from process memory via a crafted XMPP message.
- Product
- Pidgin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhg.pidgin.imlists.opensuse.org
Oct 29, 2014Absolute path traversal vulnerability in the untar_block function in win32/untar.c in Pidgin before 2.10.10 on Windows allows remote attackers to write to arbitCVE-2014-3697 · Other software · Pidgin · reported by Red HatMedium 6.4
Absolute path traversal vulnerability in the untar_block function in win32/untar.c in Pidgin before 2.10.10 on Windows allows remote attackers to write to arbitrary files via a drive name in a tar archive of a smiley theme.
- Product
- Pidgin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhg.pidgin.imlists.opensuse.org
Oct 29, 2014nmevent.c in the Novell GroupWise protocol plugin in libpurple in Pidgin before 2.10.10 allows remote servers to cause a denial of service (application crash) vCVE-2014-3696 · Other software · Pidgin · reported by Red HatMedium 5
nmevent.c in the Novell GroupWise protocol plugin in libpurple in Pidgin before 2.10.10 allows remote servers to cause a denial of service (application crash) via a crafted server message that triggers a large memory allocation.
- Product
- Pidgin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhg.pidgin.imlists.opensuse.org
Oct 29, 2014markup.c in the MXit protocol plugin in libpurple in Pidgin before 2.10.10 allows remote servers to cause a denial of service (application crash) via a large leCVE-2014-3695 · Other software · Pidgin · reported by Red HatMedium 5
markup.c in the MXit protocol plugin in libpurple in Pidgin before 2.10.10 allows remote servers to cause a denial of service (application crash) via a large length value in an emoticon response.
- Product
- Pidgin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhg.pidgin.imlists.opensuse.org
Oct 29, 2014The (1) bundled GnuTLS SSL/TLS plugin and the (2) bundled OpenSSL SSL/TLS plugin in libpurple in Pidgin before 2.10.10 do not properly consider the Basic ConstrCVE-2014-3694 · Other software · Opensuse · reported by Red HatMedium 6.4
The (1) bundled GnuTLS SSL/TLS plugin and the (2) bundled OpenSSL SSL/TLS plugin in libpurple in Pidgin before 2.10.10 do not properly consider the Basic Constraints extension during verification of X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
- Product
- Opensuse
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhg.pidgin.imlists.opensuse.org
May 22, 2014libgadu before 1.11.4 and 1.12.0 before 1.12.0-rc3, as used in Pidgin and other products, allows remote Gadu-Gadu file relay servers to cause a denial of servicCVE-2014-3775 · Other software · Libgadu · reported by MITREHigh 7.5
libgadu before 1.11.4 and 1.12.0 before 1.12.0-rc3, as used in Pidgin and other products, allows remote Gadu-Gadu file relay servers to cause a denial of service (memory overwrite) or possibly execute arbitrary code via a crafted message.
- Product
- Libgadu
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.ziew.orglists.ziew.org
Feb 6, 2014The SIMPLE protocol functionality in Pidgin before 2.10.8 allows remote attackers to have an unspecified impact via a negative Content-Length header, which trigCVE-2013-6490 · Other software · Pidgin · reported by Red HatHigh 10
The SIMPLE protocol functionality in Pidgin before 2.10.8 allows remote attackers to have an unspecified impact via a negative Content-Length header, which triggers a buffer overflow.
- Product
- Pidgin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhg.pidgin.imdebian.org
Feb 6, 2014Integer signedness error in the MXit functionality in Pidgin before 2.10.8 allows remote attackers to cause a denial of service (segmentation fault) via a craftCVE-2013-6489 · Other software · Pidgin · reported by Red HatMedium 5
Integer signedness error in the MXit functionality in Pidgin before 2.10.8 allows remote attackers to cause a denial of service (segmentation fault) via a crafted emoticon value, which triggers an integer overflow and a buffer overflow.
- Product
- Pidgin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhg.pidgin.imdebian.org
Feb 6, 2014Integer overflow in libpurple/protocols/gg/lib/http.c in the Gadu-Gadu (gg) parser in Pidgin before 2.10.8 allows remote attackers to have an unspecified impactCVE-2013-6487 · Other software · Pidgin · reported by Red HatHigh 7.5
Integer overflow in libpurple/protocols/gg/lib/http.c in the Gadu-Gadu (gg) parser in Pidgin before 2.10.8 allows remote attackers to have an unspecified impact via a large Content-Length value, which triggers a buffer overflow.
- Product
- Pidgin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordadvisories.mageia.orghg.pidgin.im
Feb 6, 2014Pidgin before 2.10.8 allows remote MSN servers to cause a denial of service (NULL pointer dereference and crash) via a crafted (1) SOAP response, (2) OIM XML reCVE-2013-6482 · Other software · Pidgin · reported by Red HatMedium 5
Pidgin before 2.10.8 allows remote MSN servers to cause a denial of service (NULL pointer dereference and crash) via a crafted (1) SOAP response, (2) OIM XML response, or (3) Content-Length header.
- Product
- Pidgin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.opensuse.orglists.opensuse.org
Feb 6, 2014libpurple/protocols/yahoo/libymsg.c in Pidgin before 2.10.8 allows remote attackers to cause a denial of service (crash) via a Yahoo! P2P message with a craftedCVE-2013-6481 · Other software · Pidgin · reported by Red HatMedium 5
libpurple/protocols/yahoo/libymsg.c in Pidgin before 2.10.8 allows remote attackers to cause a denial of service (crash) via a Yahoo! P2P message with a crafted length field, which triggers a buffer over-read.
- Product
- Pidgin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhg.pidgin.imlists.opensuse.org
Feb 6, 2014The IRC protocol plugin in libpurple in Pidgin before 2.10.8 does not validate argument counts, which allows remote IRC servers to cause a denial of service (apCVE-2014-0020 · Other software · Pidgin · reported by Red HatMedium 5
The IRC protocol plugin in libpurple in Pidgin before 2.10.8 does not validate argument counts, which allows remote IRC servers to cause a denial of service (application crash) via a crafted message.
- Product
- Pidgin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhg.pidgin.imhg.pidgin.im
Feb 6, 2014gtkutils.c in Pidgin before 2.10.8 on Windows allows user-assisted remote attackers to execute arbitrary programs via a message containing a file: URL that is iCVE-2013-6486 · Other software · Pidgin · reported by Red HatHigh 9.3
gtkutils.c in Pidgin before 2.10.8 on Windows allows user-assisted remote attackers to execute arbitrary programs via a message containing a file: URL that is improperly handled during construction of an explorer.exe command. NOTE: this vulnerability exists because of an incomplete fix for CVE-2011-3185.
- Product
- Pidgin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhg.pidgin.imlists.opensuse.org
Feb 6, 2014Buffer overflow in util.c in libpurple in Pidgin before 2.10.8 allows remote HTTP servers to cause a denial of service (application crash) or possibly have unspCVE-2013-6485 · Other software · Pidgin · reported by Red HatMedium 5
Buffer overflow in util.c in libpurple in Pidgin before 2.10.8 allows remote HTTP servers to cause a denial of service (application crash) or possibly have unspecified other impact via an invalid chunk-size field in chunked transfer-coding data.
- Product
- Pidgin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhg.pidgin.imlists.opensuse.org
Feb 6, 2014The STUN protocol implementation in libpurple in Pidgin before 2.10.8 allows remote STUN servers to cause a denial of service (out-of-bounds write operation andCVE-2013-6484 · Other software · Pidgin · reported by Red HatMedium 5
The STUN protocol implementation in libpurple in Pidgin before 2.10.8 allows remote STUN servers to cause a denial of service (out-of-bounds write operation and application crash) by triggering a socket read error.
- Product
- Pidgin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhg.pidgin.imlists.opensuse.org
Feb 6, 2014The XMPP protocol plugin in libpurple in Pidgin before 2.10.8 does not properly determine whether the from address in an iq reply is consistent with the to addrCVE-2013-6483 · Other software · Pidgin · reported by Red HatMedium 6.4
The XMPP protocol plugin in libpurple in Pidgin before 2.10.8 does not properly determine whether the from address in an iq reply is consistent with the to address in an iq request, which allows remote attackers to spoof iq traffic or cause a denial of service (NULL pointer dereference and application crash) via a crafted reply.
- Product
- Pidgin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhg.pidgin.imlists.opensuse.org
Feb 6, 2014util.c in libpurple in Pidgin before 2.10.8 does not properly allocate memory for HTTP responses that are inconsistent with the Content-Length header, which allCVE-2013-6479 · Other software · Pidgin · reported by Red HatMedium 5
util.c in libpurple in Pidgin before 2.10.8 does not properly allocate memory for HTTP responses that are inconsistent with the Content-Length header, which allows remote HTTP servers to cause a denial of service (application crash) via a crafted response.
- Product
- Pidgin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhg.pidgin.imlists.opensuse.org
Feb 6, 2014gtkimhtml.c in Pidgin before 2.10.8 does not properly interact with underlying library support for wide Pango layouts, which allows user-assisted remote attackeCVE-2013-6478 · Other software · Pidgin · reported by Red HatMedium 4.3
gtkimhtml.c in Pidgin before 2.10.8 does not properly interact with underlying library support for wide Pango layouts, which allows user-assisted remote attackers to cause a denial of service (application crash) via a long URL that is examined with a tooltip.
- Product
- Pidgin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhg.pidgin.imlists.opensuse.org
Feb 6, 2014Multiple integer signedness errors in libpurple in Pidgin before 2.10.8 allow remote attackers to cause a denial of service (application crash) via a crafted tiCVE-2013-6477 · Other software · Pidgin · reported by Red HatMedium 5
Multiple integer signedness errors in libpurple in Pidgin before 2.10.8 allow remote attackers to cause a denial of service (application crash) via a crafted timestamp value in an XMPP message.
- Product
- Pidgin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhg.pidgin.imlists.opensuse.org
Feb 6, 2014The Yahoo! protocol plugin in libpurple in Pidgin before 2.10.8 does not properly validate UTF-8 data, which allows remote attackers to cause a denial of servicCVE-2012-6152 · Other software · Pidgin · reported by Red HatMedium 5
The Yahoo! protocol plugin in libpurple in Pidgin before 2.10.8 does not properly validate UTF-8 data, which allows remote attackers to cause a denial of service (application crash) via crafted byte sequences.
- Product
- Pidgin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhg.pidgin.imlists.opensuse.org
Feb 16, 2013upnp.c in libpurple in Pidgin before 2.10.7 does not properly terminate long strings in UPnP responses, which allows remote attackers to cause a denial of serviCVE-2013-0274 · Other software · Pidgin · reported by Red HatLow 2.9
upnp.c in libpurple in Pidgin before 2.10.7 does not properly terminate long strings in UPnP responses, which allows remote attackers to cause a denial of service (application crash) by leveraging access to the local network.
- Product
- Pidgin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhg.pidgin.imlists.opensuse.org
Feb 16, 2013sametime.c in the Sametime protocol plugin in libpurple in Pidgin before 2.10.7 does not properly terminate long user IDs, which allows remote servers to cause CVE-2013-0273 · Other software · Pidgin · reported by Red HatMedium 5
sametime.c in the Sametime protocol plugin in libpurple in Pidgin before 2.10.7 does not properly terminate long user IDs, which allows remote servers to cause a denial of service (application crash) via a crafted packet.
- Product
- Pidgin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhg.pidgin.imlists.opensuse.org
Feb 16, 2013Buffer overflow in http.c in the MXit protocol plugin in libpurple in Pidgin before 2.10.7 allows remote servers to execute arbitrary code via a long HTTP headeCVE-2013-0272 · Other software · Pidgin · reported by Red HatMedium 6.8
Buffer overflow in http.c in the MXit protocol plugin in libpurple in Pidgin before 2.10.7 allows remote servers to execute arbitrary code via a long HTTP header.
- Product
- Pidgin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhg.pidgin.imlists.opensuse.org
Feb 16, 2013The MXit protocol plugin in libpurple in Pidgin before 2.10.7 might allow remote attackers to create or overwrite files via a crafted (1) mxit or (2) mxit/imageCVE-2013-0271 · Other software · Pidgin · reported by Red HatMedium 5
The MXit protocol plugin in libpurple in Pidgin before 2.10.7 might allow remote attackers to create or overwrite files via a crafted (1) mxit or (2) mxit/imagestrips pathname.
- Product
- Pidgin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhg.pidgin.imlists.opensuse.org
Aug 8, 2012cipher.c in the Cipher API in libpurple in Pidgin before 2.7.10 retains encryption-key data in process memory, which might allow local users to obtain sensitiveCVE-2011-4922 · Other software · Pidgin · reported by Red HatLow 2.1
cipher.c in the Cipher API in libpurple in Pidgin before 2.7.10 retains encryption-key data in process memory, which might allow local users to obtain sensitive information by reading a core file or other representation of memory contents.
- Product
- Pidgin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhg.pidgin.imopenwall.com
Jul 7, 2012Buffer overflow in markup.c in the MXit protocol plugin in libpurple in Pidgin before 2.10.5 allows remote attackers to execute arbitrary code via a crafted inlCVE-2012-3374 · Other software · Pidgin · reported by Red HatHigh 7.5
Buffer overflow in markup.c in the MXit protocol plugin in libpurple in Pidgin before 2.10.5 allows remote attackers to execute arbitrary code via a crafted inline image in a message.
- Product
- Pidgin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhg.pidgin.imlists.opensuse.org
Jul 3, 2012msg.c in the MSN protocol plugin in libpurple in Pidgin before 2.10.4 does not properly handle crafted characters, which allows remote servers to cause a denialCVE-2012-2318 · Other software · Pidgin · reported by Red HatMedium 5
msg.c in the MSN protocol plugin in libpurple in Pidgin before 2.10.4 does not properly handle crafted characters, which allows remote servers to cause a denial of service (application crash) by placing these characters in a text/plain message.
- Product
- Pidgin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.