CVE-2014-3698

The jabberidnvalidate function in jutil.c in the Jabber protocol plugin in libpurple in Pidgin before 2.10.10 allows remote attackers to obtain sensitive information from process memory via a crafted XMPP message...

Debian Security Advisory DSA 3055-1 (pidgin - security update)

Multiple vulnerabilities have been discovered in Pidgin, a multi-protocol instant messaging client: CVE-2014-3694 It was discovered that the SSL/TLS plugins failed to validate the basic constraints extension in intermediate CA certificates. CVE-2014-3695 Yves Younan and Richard Johnson discovered...

KLA10448 Multiple Pidgin vulnerabilities

Multiple serious vulnerabilities have been found in Pidgin. Malicious users can exploit these vulnerabilities to cause denial of service, obtain sensitive information and write local files. Below is a complete list of vulnerabilities 1. Vectors related to Jabber protocol can be exploited remotely...

PT-2014-5459

Name of the Vulnerable Software and Affected Versions Pidgin versions prior to 2.10.10 Description The issue allows remote attackers to obtain sensitive information from process memory via a crafted XMPP message. This is due to a problem in the jabber idn validate function in jutil.c in the Jabbe...

libpurple: remote dos and information leakage

A malicious server and possibly even a malicious remote user could create a carefully crafted XMPP message that causes libpurple to send an XMPP message containing arbitrary memory. A malicious server or man-in-the-middle could trigger a crash in libpurple by sending an emoticon via MXit with an...

Debian: Security Advisory (DSA-3055-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2014 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

FreeBSD : asterisk -- Remotely triggered crash (e60d9e65-3f6b-11e4-ad16-001999f8d30b)

The Asterisk project reports : When an out of call message - delivered by either the SIP or PJSIP channel driver or the XMPP stack - is handled in Asterisk, a crash can occur if the channel servicing the message is sent into the ReceiveFax dialplan application while using the resfaxspandsp module...

ChatSecure IM 2.2.4 iOS - Persistent Cross-Site Scripting

ChatSecure IM 2.2.4 iOS - Persistent Cross-Site Scripting Document Title: =============== ChatSecure IM v2.2.4 iOS - Persistent Web Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1317 Release Date: ============= 2014-09-10 Vulnerability...

ChatSecure IM 2.2.4 iOS - Persistent Cross-Site Scripting

Document Title: =============== ChatSecure IM v2.2.4 iOS - Persistent Web Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1317 Release Date: ============= 2014-09-10 Vulnerability Laboratory ID VL-ID: ==================================== 13...

asterisk -- Remotely triggered crash

The Asterisk project reports: When an out of call message - delivered by either the SIP or PJSIP channel driver or the XMPP stack - is handled in Asterisk, a crash can occur if the channel servicing the message is sent into the ReceiveFax dialplan application while using the resfaxspandsp module...

[SECURITY] Fedora 20 Update: smack-3.2.2-5.fc20

Smack is an Open Source XMPP Jabber client library for instant messaging and presence. A pure Java library, it can be embedded into your applications to create anything from a full XMPP client to simple XMPP integrations such as sending notification messages and presence-enabling devices...

Jappix Cross Site Scripting

Affected software: https://jappix.org/ Discovered by: Provensec Website: http://www.provensec.com Type of vulnerability: XSS Stored Description: Jappix is a new, smart and powerful social platform. We think each of us should own his own data, that’s why we’ve made Jappix decentralized. Jappix is...

CVE-2014-5075 MitM Vulnerability in the Smack XMPP Library for Java

CVE-2014-5075 MitM Vulnerability in the Smack XMPP Library for Java =================================================================== Smack http://www.igniterealtime.org/projects/smack/ is an Open Source XMPP Jabber client library for instant messaging and presence written in Java. Smack prior ...

Openfire < 3.9.2 XMPP-Layer DoS

The remote host is running a version of Openfire prior to 3.9.2. It is, therefore, affected by an XMPP-layer denial of service vulnerability. The vulnerability exists in 'nio/XMLLightweightParser.java' which fails to properly restrict the processing of compressed XML elements, which allows remote...

Jabber Server 2.0 - Multiple Remote Buffer Overflow Vulnerabilities

No description provided by source. source: http://www.securityfocus.com/bid/11741/info Multiple remote buffer overflow vulnerabilities affect the Jabber Server. These issues are due to a failure of the application to properly validate the length of user-supplied strings prior to copying them into...

Openfire 3.6.4 - Multiple CSRF Vulnerabilities

No description provided by source. Title: Multiple CSRF Vulnerabilities in Openfire 3.6.4 Administrative Section ------------------------------------------------------------------------ ------------------------------------------------------------------------ -- Project: Openfire Severity: High...

Important: Red Hat Security Advisory: Red Hat JBoss BRMS 6.0.2 update

Red Hat JBoss BRMS 6.0.2, which fixes multiple security issues, various bugs, and adds enhancements, is now available from the Red Hat Customer Portal. The Red Hat Security Response Team has rated this update as having Important security impact. Common Vulnerability Scoring System CVSS base score...

Important: Red Hat Security Advisory: Red Hat JBoss BPM Suite 6.0.2 update

Red Hat JBoss BPM Suite 6.0.2, which fixes multiple security issues, various bugs, and adds enhancements, is now available from the Red Hat Customer Portal. The Red Hat Security Response Team has rated this update as having Important security impact. Common Vulnerability Scoring System CVSS base...

openSUSE Security Update : pidgin / pidgin-branding-openSUSE (openSUSE-SU-2014:0239-1)

Update to version 2.10.8 bnc861019 : + General: Python build scripts and example plugins are now compatible with Python 3 pidgin.im15624. + libpurple : - Fix potential crash if libpurple gets an error attempting to read a reply from a STUN server CVE-2013-6484. - Fix potential crash parsing a...

openSUSE Security Update : finch (openSUSE-SU-2012:0066-1)

Remote users could crash pidgin via ICQ, SILC, XMPP and Yahoo protocols CVE-2011-4601, CVE-2011-4603, CVE-2011-4602, CVE-2011-1091. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from openSUSE Security Update finch-5557...