family_feedbag.c in the oscar protocol plugin in libpurple in Pidgin before 2.10.1 does not perform the expected UTF-8 validation on message data, which allows remote attackers to cause a denial of service (application crash) via a crafted (1) AIM or (2) ICQ message associated with buddy-list addition.
CVSS Details
- CVSS 3.1 Base Score: 7.5
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Centos_linux | — | Upgrade libpurple-develUpgrade finchUpgrade libpurple-tclUpgrade pidginUpgrade pidgin-docsUpgrade libpurpleUpgrade libpurple-perlUpgrade pidgin-develUpgrade pidgin-perlUpgrade finch-devel | Dec 1, 2016 | Dec 24, 2011 |
| Debian | — | Upgrade pidgin | Jul 30, 2024 | Dec 25, 2011 |
| Oracle_linux | — | Upgrade libpurpleUpgrade pidgin-perlUpgrade libpurple-tclUpgrade libpurple-perlUpgrade libpurple-develUpgrade finchUpgrade pidgin-docsUpgrade pidgin-develUpgrade pidginUpgrade finch-devel | Oct 16, 2024 | Dec 25, 2011 |
| Suse | — | Upgrade libpurple-langUpgrade libpurple-develUpgrade finch-develUpgrade pidgin-develUpgrade finchUpgrade pidginUpgrade libpurple | Dec 12, 2013 | Jun 28, 2013 |
| Ubuntu | — | Upgrade finchUpgrade libpurple0Upgrade pidgin | Nov 8, 2024 | Dec 25, 2011 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub