Masslogger Trojan Upgraded to Steal All Your Outlook, Chrome Credentials

A credential stealer infamous for targeting Windows systems has resurfaced in a new phishing campaign that aims to steal credentials from Microsoft Outlook, Google Chrome, and instant messenger apps. Primarily directed against users in Turkey, Latvia, and Italy starting mid-January, the attacks...

Huawei EulerOS: Security Advisory for pidgin (EulerOS-SA-2020-2385)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

EulerOS 2.0 SP2 : pidgin (EulerOS-SA-2020-2385)

According to the version of the pidgin package installed, the EulerOS installation on the remote host is affected by the following vulnerability : - Pidgin version 2.11.0 contains a vulnerability in X.509 Certificates imports specifically due to improper check of return values from...

EulerOS 2.0 SP5 : pidgin (EulerOS-SA-2020-2262)

According to the version of the pidgin package installed, the EulerOS installation on the remote host is affected by the following vulnerability : - Pidgin allows you to talk to anyone using a variety of messaging protocols including AIM, MSN, Yahoo!, Jabber, Bonjour, Gadu-Gadu, ICQ, IRC, Novell...

Huawei EulerOS: Security Advisory for pidgin (EulerOS-SA-2020-2262)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Huawei EulerOS: Security Advisory for pidgin (EulerOS-SA-2020-2062)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

EulerOS 2.0 SP3 : pidgin (EulerOS-SA-2020-2062)

According to the version of the pidgin package installed, the EulerOS installation on the remote host is affected by the following vulnerability : - Pidgin version 2.11.0 contains a vulnerability in X.509 Certificates imports specifically due to improper check of return values from...

Bypassing MassLogger Anti-Analysis — a Man-in-the-Middle Approach

The FireEye Front Line Applied Research & Expertise FLARE Team attempts to always stay on top of the most current and emerging threats. As a member of the FLARE Reverse Engineer team, I recently received a request to analyze a fairly new credential stealer identified as MassLogger. Despite the la...

Denial Of Service (DoS)

pidgin is vulnerable to denial of service. An input sanitization flaw was found in the way the Pidgin SILC Secure Internet Live Conferencing protocol plug-in escaped certain UTF-8 characters in channel messages. A remote attacker could use this flaw to crash Pidgin via a specially-crafted SILC...

Denial Of Service (DoS)

pidgin is vulnerable to denial of service. Multiple NULL pointer dereference flaws were found in the Jingle extension of the Extensible Messaging and Presence Protocol XMPP protocol plug-in in Pidgin. A remote attacker could use these flaws to crash Pidgin via a specially-crafted Jingle multimedi...

Denial Of Service (DoS)

pidgin is vulnerable to denial of service. An input sanitization flaw was found in the way the AOL Open System for Communication in Realtime OSCAR protocol plug-in in Pidgin, used by the AOL ICQ and AIM instant messaging systems, escaped certain UTF-8 characters. A remote attacker could use this...

Denial Of Service (DoS)

pidgin is vulnerable to denial of service DoS. The vulnerability exists as an input sanitization flaw was found in the way the Pidgin SILC Secure Internet Live Conferencing protocol plug-in escaped certain UTF-8 characters. A remote attacker could use this flaw to crash Pidgin via a...

Denial Of Service (DoS)

pidgin is vulnerable to denial of service DoS. The vulnerability exists as multiple NULL pointer dereference flaws were found in the way the Pidgin Yahoo! Messenger Protocol plug-in handled malformed YMSG packets. A remote attacker could use these flaws to crash Pidgin via a specially-crafted...

Denial Of Service (DoS)

pidgin is vulnerable to denial of service. A NULL pointer dereference flaw was found in the way the Pidgin MSN protocol plug-in processed custom emoticon messages. A remote attacker could use this flaw to crash Pidgin by sending specially-crafted emoticon messages during mutual communication...

Denial Of Service (DoS)

pidgin is vulnerable to denial of service. Multiple NULL pointer dereference flaws were found in the way Pidgin handled Base64 decoding. A remote attacker could use these flaws to crash Pidgin if the target Pidgin user was using the Yahoo! Messenger Protocol, MSN, MySpace, or Extensible Messaging...

Directory Traversal

pidgin is vulnerable to directory traversal. The vulnerability exists as a remote attacker could send a specially-crafted emoticon image download request that would cause Pidgin to disclose an arbitrary file readable to the user running Pidgin...

Arbitrary Code Execution

pidgin is vulnerable to arbitrary code execution. If a user received a malicious MSN message, it was possible to execute arbitrary code with the permissions of the user running Pidgin...

Denial Of Service (DoS)

pidgin is vulnerable to denial of service. A remote attacker could flood the victim with emoticon images during mutual communication, leading to excessive CPU use...

Denial Of Service (DoS)

Pidgin is vulnerable to Denial of Service DoS.An input sanitization flaw was found in the way Pidgin's MSN protocol implementation handled MSNSLP invitations. A remote attacker could send a specially-crafted INVITE request that would cause a denial of service memory corruption and Pidgin crash...

Denial Of Service (DoS)

pidgin is vulnerable to denial of service. A denial of service flaw was found in Finch's XMPP chat implementation, when using multi-user chat. If a Finch user in a multi-user chat session were to change their nickname to contain the HTML "br" element, it would cause Finch to crash...