The XMPP protocol plugin in libpurple in Pidgin before 2.6.2 does not properly handle an error IQ stanza during an attempted fetch of a custom smiley, which allows remote attackers to cause a denial of service (application crash) via XHTML-IM content with cid: images.
CVSS Details
- CVSS 3.1 Base Score: 7.5
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Centos_linux | — | Upgrade libpurple-develUpgrade pidgin-perlUpgrade finch-develUpgrade pidginUpgrade pidgin-develUpgrade libpurple-tclUpgrade libpurpleUpgrade libpurple-perlUpgrade finch | Dec 1, 2016 | Sep 8, 2009 |
| Debian | — | Upgrade pidgin | Jul 30, 2024 | Sep 8, 2009 |
| Suse | — | Upgrade famUpgrade libpurple-branding-upstreamUpgrade libpurple-langUpgrade finch-develUpgrade liboil-x86Upgrade liboil-32bitUpgrade liboilUpgrade cdparanoia-x86Upgrade cdparanoia-32bitUpgrade gnome-vfs2Upgrade libogg0-32bitUpgrade fam-32bitUpgrade pidgin-develUpgrade libpurple-tclUpgrade libogg0Upgrade libpurple-meanwhileUpgrade finchUpgrade desktop-file-utilsUpgrade gstreamer-0_10Upgrade libpurpleUpgrade libpurple-develUpgrade libpurple-plugin-sametimeUpgrade gnome-vfs2-x86Upgrade fam-x86Upgrade cdparanoiaUpgrade gnome-vfs2-32bitUpgrade pidginUpgrade libogg0-x86 | Feb 17, 2015 | Jun 28, 2013 |
| Ubuntu | — | Upgrade pidgin | Nov 8, 2024 | Sep 8, 2009 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub