The silc_channel_message function in ops.c in the SILC protocol plugin in libpurple in Pidgin before 2.10.1 does not perform the expected UTF-8 validation on message data, which allows remote attackers to cause a denial of service (application crash) via a crafted message, a different vulnerability than CVE-2011-3594.
CVSS Details
- CVSS 3.1 Base Score: 7.5
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Centos_linux | — | Upgrade finchUpgrade pidgin-perlUpgrade pidgin-develUpgrade libpurple-perlUpgrade finch-develUpgrade libpurpleUpgrade libpurple-develUpgrade libpurple-tclUpgrade pidgin | Dec 1, 2016 | Dec 16, 2011 |
| Debian | — | Upgrade pidgin | Jul 30, 2024 | Dec 17, 2011 |
| Suse | — | Upgrade finch-develUpgrade pidgin-develUpgrade libpurple-langUpgrade libpurpleUpgrade finchUpgrade pidginUpgrade libpurple-devel | Dec 12, 2013 | Jun 28, 2013 |
| Ubuntu | — | Upgrade finchUpgrade pidginUpgrade libpurple0 | Nov 8, 2024 | Dec 17, 2011 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub