CVE-2013-6482

Pidgin before 2.10.8 allows remote MSN servers to cause a denial of service NULL pointer dereference and crash via a crafted 1 SOAP response, 2 OIM XML response, or 3 Content-Length header...

CVE-2013-6489

Integer signedness error in the MXit functionality in Pidgin before 2.10.8 allows remote attackers to cause a denial of service segmentation fault via a crafted emoticon value, which triggers an integer overflow and a buffer overflow...

CVE-2013-6490

The SIMPLE protocol functionality in Pidgin before 2.10.8 allows remote attackers to have an unspecified impact via a negative Content-Length header, which triggers a buffer overflow...

CVE-2013-6481

libpurple/protocols/yahoo/libymsg.c in Pidgin before 2.10.8 allows remote attackers to cause a denial of service crash via a Yahoo! P2P message with a crafted length field, which triggers a buffer over-read...

CVE-2013-6482

Pidgin before 2.10.8 allows remote MSN servers to cause a denial of service NULL pointer dereference and crash via a crafted 1 SOAP response, 2 OIM XML response, or 3 Content-Length header...

CVE-2013-6481

libpurple/protocols/yahoo/libymsg.c in Pidgin before 2.10.8 allows remote attackers to cause a denial of service crash via a Yahoo! P2P message with a crafted length field, which triggers a buffer over-read...

CVE-2013-6490

Pidgin (up to 2.10.8) is affected by CVE-2013-6490 due to a buffer overflow in the SIMPLE protocol header parsing when handling a negative Content-Length header. The issue is fixed in later Pidgin releases (e.g., 2.10.9 multiple advisories), so upgrade to a version newer than 2.10.8 to mitigate. ...

CVE-2013-6482

Pidgin before 2.10.8 allows remote MSN servers to cause a denial of service NULL pointer dereference and crash via a crafted 1 SOAP response, 2 OIM XML response, or 3 Content-Length header...

CVE-2013-6489

Integer signedness error in the MXit functionality in Pidgin before 2.10.8 allows remote attackers to cause a denial of service segmentation fault via a crafted emoticon value, which triggers an integer overflow and a buffer overflow...

CVE-2013-6482

Pidgin (libpurple) is affected by CVE-2013-6482, a set of NULL pointer dereference flaws in MSN message parsing that can be triggered by crafted MSN data (SOAP, OIM XML, or Content-Length headers), leading to a denial of service. The issue is reported for Pidgin prior to version 2.10.8. Multiple ...

CVE-2013-6481

The CVE-2013-6481 vulnerability affects Pidgin (libpurple) Yahoo protocol support: the Yahoo! P2P message handling in libpurple/libymsg.c can crash the client due to a crafted length field, caused by a buffer over-read. This leads to remote-initiated denial of service (application crash). Affecte...

CVE-2013-6481

libpurple/protocols/yahoo/libymsg.c in Pidgin before 2.10.8 allows remote attackers to cause a denial of service crash via a Yahoo! P2P message with a crafted length field, which triggers a buffer over-read...

CVE-2013-6490

The SIMPLE protocol functionality in Pidgin before 2.10.8 allows remote attackers to have an unspecified impact via a negative Content-Length header, which triggers a buffer overflow...

CVE-2013-6487

Integer overflow in libpurple/protocols/gg/lib/http.c in the Gadu-Gadu gg parser in Pidgin before 2.10.8 allows remote attackers to have an unspecified impact via a large Content-Length value, which triggers a buffer overflow...

CVE-2013-6487

CVE-2013-6487 affects Pidgin/libgadu: Integer/Content-Length handling in the Gadu-Gadu parser (gg) in libpurple/http.c can overflow a buffer when a large Content-Length is processed. This vulnerability is described as allowing a buffer overflow with potential remote code execution or crash. Publi...

USN-2100-1: Pidgin vulnerabilities

Thijs Alkemade and Robert Vehse discovered that Pidgin incorrectly handled the Yahoo! protocol. A remote attacker could use this issue to cause Pidgin to crash, resulting in a denial of service. CVE-2012-6152 Jaime Breva Ribes discovered that Pidgin incorrectly handled the XMPP protocol. A remote...

CVE-2013-6477

Multiple integer signedness errors in libpurple in Pidgin before 2.10.8 allow remote attackers to cause a denial of service application crash via a crafted timestamp value in an XMPP message...

CVE-2013-6477

Pidgin/libpurple prior to version 2.10.8 is vulnerable to a denial of service via a crafted timestamp in an XMPP message, caused by multiple integer signedness errors in the codepath handling XMPP timestamps. The issue is explicitly identified as CVE-2013-6477. Connected advisories show that the ...

CVE-2013-6486

gtkutils.c in Pidgin before 2.10.8 on Windows allows user-assisted remote attackers to execute arbitrary programs via a message containing a file: URL that is improperly handled during construction of an explorer.exe command. NOTE: this vulnerability exists because of an incomplete fix for...

CVE-2013-6483

CVE-2013-6483 affects the XMPP protocol plugin in libpurple/Pidgin prior to version 2.10.8. The flaw arises from not consistently verifying that the from address in an IQ reply matches the to address in the IQ request, which can allow remote attackers to spoof IQ traffic and trigger a denial of s...