The silc_channel_message function in ops.c in the SILC protocol plugin in libpurple in Pidgin before 2.10.1 does not perform the expected UTF-8 validation on message data, which allows remote attackers to cause a denial of service (application crash) via a crafted message, a different vulnerability than CVE-2011-3594.
CVSS Details
- CVSS 3.1 Base Score: 7.5
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Centos_linux | — | Upgrade pidgin-develUpgrade finch-develUpgrade pidgin-perlUpgrade finchUpgrade libpurple-perlUpgrade libpurple-develUpgrade libpurple-tclUpgrade libpurpleUpgrade pidgin | Dec 1, 2016 | Dec 16, 2011 |
| Debian | — | Upgrade pidgin | Jul 30, 2024 | Dec 17, 2011 |
| Suse | — | Upgrade libpurpleUpgrade libpurple-develUpgrade finchUpgrade pidginUpgrade libpurple-langUpgrade finch-develUpgrade pidgin-devel | Dec 12, 2013 | Jun 28, 2013 |
| Ubuntu | — | Upgrade libpurple0Upgrade pidginUpgrade finch | Nov 8, 2024 | Dec 17, 2011 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub