libpurple in Finch in Pidgin before 2.6.6, when an XMPP multi-user chat (MUC) room is used, does not properly parse nicknames containing <br> sequences, which allows remote attackers to cause a denial of service (application crash) via a crafted nickname.
CVSS Details
- CVSS 3.1 Base Score: 5.3
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Centos_linux | — | Upgrade pidginUpgrade finch-develUpgrade pidgin-perlUpgrade libpurple-perlUpgrade finchUpgrade libpurple-develUpgrade pidgin-develUpgrade libpurple-tclUpgrade libpurple | Dec 1, 2016 | Feb 24, 2010 |
| Debian | — | Upgrade pidgin | Jul 30, 2024 | Feb 24, 2010 |
| Freebsd | — | Upgrade pidginUpgrade libpurple | Dec 10, 2025 | Apr 20, 2010 |
| Suse | — | Upgrade libpurple-branding-upstreamUpgrade finch-develUpgrade pidginUpgrade libpurpleUpgrade finchUpgrade pidgin-develUpgrade libpurple-tclUpgrade libpurple-plugin-sametimeUpgrade libpurple-langUpgrade libpurple-develUpgrade libpurple-meanwhile | Feb 17, 2015 | Jun 28, 2013 |
| Ubuntu | — | Upgrade pidgin | Nov 8, 2024 | Feb 24, 2010 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub