The silc_channel_message function in ops.c in the SILC protocol plugin in libpurple in Pidgin before 2.10.1 does not perform the expected UTF-8 validation on message data, which allows remote attackers to cause a denial of service (application crash) via a crafted message, a different vulnerability than CVE-2011-3594.
CVSS Details
- CVSS 3.1 Base Score: 7.5
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Centos_linux | — | Upgrade pidgin-develUpgrade finchUpgrade finch-develUpgrade libpurple-perlUpgrade pidgin-perlUpgrade pidginUpgrade libpurpleUpgrade libpurple-tclUpgrade libpurple-devel | Dec 1, 2016 | Dec 16, 2011 |
| Debian | — | Upgrade pidgin | Jul 30, 2024 | Dec 17, 2011 |
| Suse | — | Upgrade libpurple-develUpgrade libpurpleUpgrade finchUpgrade pidginUpgrade pidgin-develUpgrade libpurple-langUpgrade finch-devel | Dec 12, 2013 | Jun 28, 2013 |
| Ubuntu | — | Upgrade pidginUpgrade finchUpgrade libpurple0 | Nov 8, 2024 | Dec 17, 2011 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub