The XMPP protocol plugin in libpurple in Pidgin before 2.10.1 does not properly handle missing fields in (1) voice-chat and (2) video-chat stanzas, which allows remote attackers to cause a denial of service (application crash) via a crafted message.
CVSS Details
- CVSS 3.1 Base Score: 7.5
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Centos_linux | — | Upgrade libpurpleUpgrade libpurple-develUpgrade pidginUpgrade pidgin-docsUpgrade libpurple-tclUpgrade pidgin-develUpgrade pidgin-perlUpgrade finchUpgrade libpurple-perlUpgrade finch-devel | Dec 1, 2016 | Dec 16, 2011 |
| Debian | — | Upgrade pidgin | Jul 30, 2024 | Dec 17, 2011 |
| Oracle_linux | — | Upgrade finch-develUpgrade libpurple-perlUpgrade pidgin-docsUpgrade pidgin-develUpgrade libpurpleUpgrade finchUpgrade pidgin-perlUpgrade pidginUpgrade libpurple-develUpgrade libpurple-tcl | Oct 16, 2024 | Dec 17, 2011 |
| Suse | — | Upgrade libpurpleUpgrade finch-develUpgrade libpurple-langUpgrade finchUpgrade pidgin-develUpgrade pidginUpgrade libpurple-devel | Dec 12, 2013 | Jun 28, 2013 |
| Ubuntu | — | Upgrade libpurple0Upgrade finchUpgrade pidgin | Nov 8, 2024 | Dec 17, 2011 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub