The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report
protocols/jabber/auth.c in libpurple in Pidgin 2.6.0, and possibly other versions, does not follow the "require TLS/SSL" preference when connecting to older Jabber servers that do not follow the XMPP specification, which causes libpurple to connect to the server without the expected encryption and allows remote attackers to sniff sessions.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Centos_linux | — | Upgrade libpurple-tclUpgrade pidginUpgrade libpurpleUpgrade pidgin-develUpgrade finch-develUpgrade finchUpgrade libpurple-perlUpgrade libpurple-develUpgrade pidgin-perl | Dec 1, 2016 | Aug 31, 2009 |
| Debian | — | Upgrade pidgin | Jul 30, 2024 | Aug 31, 2009 |
| Gentoo Linux | — | Upgrade net-im/pidgin. | Oct 30, 2017 | Aug 31, 2009 |
| Suse | — | Upgrade desktop-file-utilsUpgrade libogg0Upgrade finch-develUpgrade libpurple-tclUpgrade libogg0-x86Upgrade pidgin-develUpgrade liboil-x86Upgrade fam-32bitUpgrade libpurple-langUpgrade libpurple-branding-upstreamUpgrade gnome-vfs2-32bitUpgrade fam-x86Upgrade libpurple-plugin-sametimeUpgrade gnome-vfs2-x86Upgrade liboilUpgrade liboil-32bitUpgrade gnome-vfs2Upgrade cdparanoia-x86Upgrade gstreamer-0_10Upgrade finchUpgrade libpurple-meanwhileUpgrade libpurpleUpgrade pidginUpgrade libpurple-develUpgrade cdparanoia-32bitUpgrade libogg0-32bitUpgrade cdparanoiaUpgrade fam | Feb 17, 2015 | Jun 28, 2013 |
| Ubuntu | — | Upgrade pidgin | Nov 8, 2024 | Aug 31, 2009 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub