libpurple in Finch in Pidgin before 2.6.6, when an XMPP multi-user chat (MUC) room is used, does not properly parse nicknames containing <br> sequences, which allows remote attackers to cause a denial of service (application crash) via a crafted nickname.
CVSS Details
- CVSS 3.1 Base Score: 5.3
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Centos_linux | — | Upgrade pidginUpgrade pidgin-perlUpgrade finch-develUpgrade finchUpgrade pidgin-develUpgrade libpurple-tclUpgrade libpurpleUpgrade libpurple-develUpgrade libpurple-perl | Dec 1, 2016 | Feb 24, 2010 |
| Debian | — | Upgrade pidgin | Jul 30, 2024 | Feb 24, 2010 |
| Freebsd | — | Upgrade pidginUpgrade libpurple | Dec 10, 2025 | Apr 20, 2010 |
| Suse | — | Upgrade finch-develUpgrade libpurple-branding-upstreamUpgrade pidginUpgrade libpurple-develUpgrade libpurple-plugin-sametimeUpgrade libpurpleUpgrade finchUpgrade libpurple-langUpgrade pidgin-develUpgrade libpurple-meanwhileUpgrade libpurple-tcl | Feb 17, 2015 | Jun 28, 2013 |
| Ubuntu | — | Upgrade pidgin | Nov 8, 2024 | Feb 24, 2010 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub