Null pointer dereference

The XMPP protocol plugin in libpurple in Pidgin before 2.10.8 does not properly determine whether the from address in an iq reply is consistent with the to address in an iq request, which allows remote attackers to spoof iq traffic or cause a denial of service NULL pointer dereference and...

Out-of-bounds

The STUN protocol implementation in libpurple in Pidgin before 2.10.8 allows remote STUN servers to cause a denial of service out-of-bounds write operation and application crash by triggering a socket read error...

Design/Logic Flaw

The Yahoo! protocol plugin in libpurple in Pidgin before 2.10.8 does not properly validate UTF-8 data, which allows remote attackers to cause a denial of service application crash via crafted byte sequences...

Buffer overflow

Buffer overflow in util.c in libpurple in Pidgin before 2.10.8 allows remote HTTP servers to cause a denial of service application crash or possibly have unspecified other impact via an invalid chunk-size field in chunked transfer-coding data...

Code injection

The IRC protocol plugin in libpurple in Pidgin before 2.10.8 does not validate argument counts, which allows remote IRC servers to cause a denial of service application crash via a crafted message...

CVE-2013-6481

libpurple/protocols/yahoo/libymsg.c in Pidgin before 2.10.8 allows remote attackers to cause a denial of service crash via a Yahoo! P2P message with a crafted length field, which triggers a buffer over-read...

CVE-2013-6487

Integer overflow in libpurple/protocols/gg/lib/http.c in the Gadu-Gadu gg parser in Pidgin before 2.10.8 allows remote attackers to have an unspecified impact via a large Content-Length value, which triggers a buffer overflow...

CVE-2013-6487

CVE-2013-6487 affects Pidgin/libgadu: Integer/Content-Length handling in the Gadu-Gadu parser (gg) in libpurple/http.c can overflow a buffer when a large Content-Length is processed. This vulnerability is described as allowing a buffer overflow with potential remote code execution or crash. Publi...

CVE-2013-6483

The XMPP protocol plugin in libpurple in Pidgin before 2.10.8 does not properly determine whether the from address in an iq reply is consistent with the to address in an iq request, which allows remote attackers to spoof iq traffic or cause a denial of service NULL pointer dereference and...

CVE-2013-6483

CVE-2013-6483 affects the XMPP protocol plugin in libpurple/Pidgin prior to version 2.10.8. The flaw arises from not consistently verifying that the from address in an IQ reply matches the to address in the IQ request, which can allow remote attackers to spoof IQ traffic and trigger a denial of s...

CVE-2013-6484

CVE-2013-6484 concerns the STUN protocol implementation in libpurple (Pidgin) prior to 2.10.8. The advisory states that remote STUN servers can trigger a socket read error, leading to an out-of-bounds write and an application crash (DoS). The vulnerability affects Pidgin’s STUN handling in the li...

CVE-2012-6152

CVE-2012-6152 affects Pidgin’s Yahoo! protocol plugin (libpurple) before 2.10.8. The vulnerability arises from improper validation of UTF-8 data, enabling a remote attacker to crash the application (DoS) via crafted byte sequences. Affected: Pidgin/libpurple up to version 2.10.7.x; remediator: up...

CVE-2013-6479

The CVE-2013-6479 issue affects Pidgin/libpurple: util.c does not allocate memory correctly for HTTP responses that conflict with Content-Length, enabling a crafted response from a remote HTTP server to crash the application (DoS). Public records across vendors indicate this vulnerability was add...

CVE-2013-6477

Pidgin/libpurple prior to version 2.10.8 is vulnerable to a denial of service via a crafted timestamp in an XMPP message, caused by multiple integer signedness errors in the codepath handling XMPP timestamps. The issue is explicitly identified as CVE-2013-6477. Connected advisories show that the ...

CVE-2012-6152

The Yahoo! protocol plugin in libpurple in Pidgin before 2.10.8 does not properly validate UTF-8 data, which allows remote attackers to cause a denial of service application crash via crafted byte sequences...

CVE-2013-6479

util.c in libpurple in Pidgin before 2.10.8 does not properly allocate memory for HTTP responses that are inconsistent with the Content-Length header, which allows remote HTTP servers to cause a denial of service application crash via a crafted response...

CVE-2013-6485

CVE-2013-6485 affects Pidgin/libpurple: buffer overflow in util.c when parsing HTTP responses with chunked transfer-coding, caused by improper memory allocation for responses, leading to denial of service (application crash) or unspecified impact. Public advisories show remediation by updating to...

CVE-2013-6485

Buffer overflow in util.c in libpurple in Pidgin before 2.10.8 allows remote HTTP servers to cause a denial of service application crash or possibly have unspecified other impact via an invalid chunk-size field in chunked transfer-coding data...

CVE-2014-0020

The CVE-2014-0020 entry applies to Pidgin with libpurple’s IRC protocol plugin (pre-2.10.8). The issue is that the IRC plugin does not validate argument counts, allowing remote IRC servers to crash the application (DoS) via a crafted message. Public advisories across distributions indicate this h...

CVE-2013-6479

util.c in libpurple in Pidgin before 2.10.8 does not properly allocate memory for HTTP responses that are inconsistent with the Content-Length header, which allows remote HTTP servers to cause a denial of service application crash via a crafted response...