proxy.c in libpurple in Pidgin before 2.10.4 does not properly handle canceled SOCKS5 connection attempts, which allows user-assisted remote authenticated users to cause a denial of service (application crash) via a sequence of XMPP file-transfer requests.
CVSS Details
- CVSS 3.1 Base Score: 4.3
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade pidgin | Sep 20, 2017 | Jul 3, 2012 |
| Debian | — | Upgrade pidgin | Jul 30, 2024 | Jul 3, 2012 |
| Freebsd | — | Upgrade libpurple | Dec 10, 2025 | May 12, 2012 |
| Oracle Solaris | — | Upgrade communication/im/pidgin to version 2.10.4-0.175.0.10.0.3.0 on Solaris 11.0 | May 29, 2017 | Jul 3, 2012 |
| Suse | — | Upgrade finch-develUpgrade libpurple-langUpgrade pidgin-develUpgrade libpurple-branding-upstreamUpgrade pidginUpgrade libpurple-meanwhileUpgrade libpurple-plugin-sametimeUpgrade libpurple-tclUpgrade finchUpgrade libpurple-develUpgrade libpurple | Feb 17, 2015 | Jun 28, 2013 |
| Ubuntu | — | Upgrade libpurple0Upgrade pidginUpgrade finch | Nov 8, 2024 | Jul 3, 2012 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub