protocols/jabber/auth.c in libpurple in Pidgin 2.6.0, and possibly other versions, does not follow the "require TLS/SSL" preference when connecting to older Jabber servers that do not follow the XMPP specification, which causes libpurple to connect to the server without the expected encryption and allows remote attackers to sniff sessions.
CVSS Details
- CVSS 3.1 Base Score: 5.3
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Centos_linux | — | Upgrade libpurple-tclUpgrade pidgin-develUpgrade finch-develUpgrade pidginUpgrade libpurpleUpgrade finchUpgrade libpurple-develUpgrade libpurple-perlUpgrade pidgin-perl | Dec 1, 2016 | Aug 31, 2009 |
| Debian | — | Upgrade pidgin | Jul 30, 2024 | Aug 31, 2009 |
| Gentoo Linux | — | Upgrade net-im/pidgin. | Oct 30, 2017 | Aug 31, 2009 |
| Suse | — | Upgrade liboilUpgrade gnome-vfs2-x86Upgrade gstreamer-0_10Upgrade libogg0-32bitUpgrade liboil-32bitUpgrade famUpgrade gnome-vfs2Upgrade libpurple-plugin-sametimeUpgrade cdparanoiaUpgrade libpurple-meanwhileUpgrade libpurple-develUpgrade fam-x86Upgrade cdparanoia-x86Upgrade libpurpleUpgrade finchUpgrade cdparanoia-32bitUpgrade pidginUpgrade libpurple-langUpgrade gnome-vfs2-32bitUpgrade pidgin-develUpgrade libogg0-x86Upgrade libogg0Upgrade libpurple-tclUpgrade liboil-x86Upgrade desktop-file-utilsUpgrade finch-develUpgrade libpurple-branding-upstreamUpgrade fam-32bit | Feb 17, 2015 | Jun 28, 2013 |
| Ubuntu | — | Upgrade pidgin | Nov 8, 2024 | Aug 31, 2009 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub