PI
Product
Pidgin
87
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 2High 7Medium 11Low 2
Watch
Add Pidgin to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2016-1000030 | 9.8 | Sep 5 | Pidgin version <2.11.0 contains a vulnerability in X.509 Certificates imports specifically due to improper check of return values from gnutls_x509_crt_init() and… Affected: before 2.11.0 |
| CVE-2017-2640 | 9.8 | Jul 27 | An out-of-bounds write flaw was found in the way Pidgin before 2.12.0 processed XML content Affected: before 2.12.0 |
| CVE-2016-2378 | 8.1 | Jan 6 | A buffer overflow vulnerability exists in the handling of the MXIT protocol Pidgin Affected: through 2.10.12 |
| CVE-2016-2377 | 8.1 | Jan 6 | A buffer overflow vulnerability exists in the handling of the MXIT protocol in Pidgin Affected: through 2.10.12 |
| CVE-2016-2376 | 8.1 | Jan 6 | A buffer overflow vulnerability exists in the handling of the MXIT protocol in Pidgin Affected: through 2.10.12 |
| CVE-2016-2374 | 8.1 | Jan 6 | An exploitable memory corruption vulnerability exists in the handling of the MXIT protocol in Pidgin Affected: through 2.10.12 |
| CVE-2016-2371 | 8.1 | Jan 6 | An out-of-bounds write vulnerability exists in the handling of the MXIT protocol in Pidgin Affected: through 2.10.12 |
| CVE-2016-2368 | 8.1 | Jan 6 | Multiple memory corruption vulnerabilities exist in the handling of the MXIT protocol in Pidgin Affected: through 2.10.12 |
| CVE-2010-0013 | 7.5 | Jan 9 | Directory traversal vulnerability in slp.c in the MSN protocol plugin in libpurple in Pidgin 2.6.4 and Adium 1.3.8 allows remote attackers to read arbitrary files via a Affected: 2.6.4 |
| CVE-2022-26491 | 5.9 | Jun 2 | An issue was discovered in Pidgin before 2.14.9 Affected: before 2.14.9 |
| CVE-2016-2373 | 5.9 | Jan 6 | A denial of service vulnerability exists in the handling of the MXIT protocol in Pidgin Affected: through 2.10.12 |
| CVE-2016-2372 | 5.9 | Jan 6 | An information leak exists in the handling of the MXIT protocol in Pidgin Affected: through 2.10.12 |
| CVE-2016-2370 | 5.9 | Jan 6 | A denial of service vulnerability exists in the handling of the MXIT protocol in Pidgin Affected: through 2.10.12 |
| CVE-2016-2369 | 5.9 | Jan 6 | A NULL pointer dereference vulnerability exists in the handling of the MXIT protocol in Pidgin Affected: through 2.10.12 |
| CVE-2016-2367 | 5.9 | Jan 6 | An information leak exists in the handling of the MXIT protocol in Pidgin Affected: through 2.10.12 |
| CVE-2016-2366 | 5.9 | Jan 6 | A denial of service vulnerability exists in the handling of the MXIT protocol in Pidgin Affected: through 2.10.12 |
| CVE-2016-2365 | 5.9 | Jan 6 | A denial of service vulnerability exists in the handling of the MXIT protocol in Pidgin Affected: through 2.10.12 |
| CVE-2019-25544 | 5.5 | Mar 21 | Pidgin 2.13.0 Denial of Service via Malformed Username Affected: 2.13.0 |
| CVE-2012-1257 | 5.5 | Nov 20 | Pidgin 2.10.0 uses DBUS for certain cleartext communication, which allows local users to obtain sensitive information via a dbus session monitor Affected: 2.10.0 |
| CVE-2016-2375 | 5.3 | Jan 6 | An exploitable out-of-bounds read exists in the handling of the MXIT protocol in Pidgin Affected: through 2.10.12 |
| CVE-2016-4323 | 3.7 | Jan 6 | A directory traversal exists in the handling of the MXIT protocol in Pidgin Affected: through 2.10.12 |
| CVE-2016-2380 | 3.1 | Jan 6 | An information leak exists in the handling of the MXIT protocol in Pidgin Affected: through 2.10.12 |
| CVE-2014-3698 | – | Oct 29 | The jabber_idn_validate function in jutil.c in the Jabber protocol plugin in libpurple in Pidgin before 2.10.10 allows remote attackers to obtain sensitive information from… Affected: through 2.10.9; 2.10.0; 2.10.1; 2.10.2; 2.10.3; 2.10.4; +4 more |
| CVE-2014-3697 | – | Oct 29 | Absolute path traversal vulnerability in the untar_block function in win32/untar.c in Pidgin before 2.10.10 on Windows allows remote attackers to write to arbitrary files via a… Affected: through 2.10.9; 2.10.0; 2.10.1; 2.10.2; 2.10.3; 2.10.4; +4 more |
| CVE-2014-3696 | – | Oct 29 | nmevent.c in the Novell GroupWise protocol plugin in libpurple in Pidgin before 2.10.10 allows remote servers to cause a denial of service (application crash) via a crafted server… Affected: through 2.10.9; 2.10.0; 2.10.1; 2.10.2; 2.10.3; 2.10.4; +4 more |
| CVE-2014-3695 | – | Oct 29 | markup.c in the MXit protocol plugin in libpurple in Pidgin before 2.10.10 allows remote servers to cause a denial of service (application crash) via a large length value in an… Affected: through 2.10.9; 2.10.0; 2.10.1; 2.10.2; 2.10.3; 2.10.4; +4 more |
| CVE-2014-3694 | – | Oct 29 | The (1) bundled GnuTLS SSL/TLS plugin and the (2) bundled OpenSSL SSL/TLS plugin in libpurple in Pidgin before 2.10.10 do not properly consider the Basic Constraints extension… Affected: through 2.10.9; 2.10.0; 2.10.1; 2.10.2; 2.10.3; 2.10.4; +4 more |
| CVE-2013-6490 | – | Feb 6 | The SIMPLE protocol functionality in Pidgin before 2.10.8 allows remote attackers to have an unspecified impact via a negative Content-Length header, which triggers a buffer… Affected: through 2.10.7; 2.0.0; 2.0.1; 2.0.2; 2.1.0; 2.1.1; +34 more |
| CVE-2013-6489 | – | Feb 6 | Integer signedness error in the MXit functionality in Pidgin before 2.10.8 allows remote attackers to cause a denial of service (segmentation fault) via a crafted emoticon value,… Affected: through 2.10.7; 2.0.0; 2.0.1; 2.0.2; 2.1.0; 2.1.1; +34 more |
| CVE-2013-6487 | – | Feb 6 | Integer overflow in libpurple/protocols/gg/lib/http.c in the Gadu-Gadu (gg) parser in Pidgin before 2.10.8 allows remote attackers to have an unspecified impact via a large… Affected: through 2.10.7; 2.0.0; 2.0.1; 2.0.2; 2.0.2; 2.1.0; +8 more |
| CVE-2013-6482 | – | Feb 6 | Pidgin before 2.10.8 allows remote MSN servers to cause a denial of service (NULL pointer dereference and crash) via a crafted (1) SOAP response, (2) OIM XML response, or (3)… Affected: through 2.10.7; 2.0.0; 2.0.1; 2.0.2; 2.1.0; 2.1.1; +34 more |
| CVE-2013-6481 | – | Feb 6 | libpurple/protocols/yahoo/libymsg.c in Pidgin before 2.10.8 allows remote attackers to cause a denial of service (crash) via a Yahoo! P2P message with a crafted length field,… Affected: through 2.10.7; 2.0.0; 2.0.1; 2.0.2; 2.1.0; 2.1.1; +34 more |
| CVE-2014-0020 | – | Feb 6 | The IRC protocol plugin in libpurple in Pidgin before 2.10.8 does not validate argument counts, which allows remote IRC servers to cause a denial of service (application crash)… Affected: through 2.10.7; 2.0.0; 2.0.1; 2.0.2; 2.1.0; 2.1.1; +34 more |
| CVE-2013-6486 | – | Feb 6 | gtkutils.c in Pidgin before 2.10.8 on Windows allows user-assisted remote attackers to execute arbitrary programs via a message containing a file: URL that is improperly handled… Affected: through 2.10.7; 2.0.0; 2.0.1; 2.0.2; 2.1.0; 2.1.1; +34 more |
| CVE-2013-6485 | – | Feb 6 | Buffer overflow in util.c in libpurple in Pidgin before 2.10.8 allows remote HTTP servers to cause a denial of service (application crash) or possibly have unspecified other… Affected: through 2.10.7; 2.0.0; 2.0.1; 2.0.2; 2.1.0; 2.1.1; +34 more |
| CVE-2013-6484 | – | Feb 6 | The STUN protocol implementation in libpurple in Pidgin before 2.10.8 allows remote STUN servers to cause a denial of service (out-of-bounds write operation and application crash)… Affected: through 2.10.7; 2.0.0; 2.0.1; 2.0.2; 2.1.0; 2.1.1; +34 more |
| CVE-2013-6483 | – | Feb 6 | The XMPP protocol plugin in libpurple in Pidgin before 2.10.8 does not properly determine whether the from address in an iq reply is consistent with the to address in an iq… Affected: through 2.10.7; 2.0.0; 2.0.1; 2.0.2; 2.1.0; 2.1.1; +34 more |
| CVE-2013-6479 | – | Feb 6 | util.c in libpurple in Pidgin before 2.10.8 does not properly allocate memory for HTTP responses that are inconsistent with the Content-Length header, which allows remote HTTP… Affected: through 2.10.7; 2.0.0; 2.0.1; 2.0.2; 2.1.0; 2.1.1; +34 more |
| CVE-2013-6478 | – | Feb 6 | gtkimhtml.c in Pidgin before 2.10.8 does not properly interact with underlying library support for wide Pango layouts, which allows user-assisted remote attackers to cause a… Affected: through 2.10.7; 2.0.0; 2.0.1; 2.0.2; 2.1.0; 2.1.1; +34 more |
| CVE-2013-6477 | – | Feb 6 | Multiple integer signedness errors in libpurple in Pidgin before 2.10.8 allow remote attackers to cause a denial of service (application crash) via a crafted timestamp value in an… Affected: through 2.10.7; 2.0.0; 2.0.1; 2.0.2; 2.1.0; 2.1.1; +34 more |
| CVE-2012-6152 | – | Feb 6 | The Yahoo! protocol plugin in libpurple in Pidgin before 2.10.8 does not properly validate UTF-8 data, which allows remote attackers to cause a denial of service (application… Affected: through 2.10.7; 2.0.0; 2.0.1; 2.0.2; 2.1.0; 2.1.1; +34 more |
| CVE-2013-0274 | – | Feb 16 | upnp.c in libpurple in Pidgin before 2.10.7 does not properly terminate long strings in UPnP responses, which allows remote attackers to cause a denial of service (application… Affected: through 2.10.6; 2.0.0; 2.0.1; 2.0.2; 2.1.0; 2.1.1; +34 more |
| CVE-2013-0273 | – | Feb 16 | sametime.c in the Sametime protocol plugin in libpurple in Pidgin before 2.10.7 does not properly terminate long user IDs, which allows remote servers to cause a denial of service… Affected: through 2.10.6; 2.0.0; 2.0.1; 2.0.2; 2.1.0; 2.1.1; +34 more |
| CVE-2013-0272 | – | Feb 16 | Buffer overflow in http.c in the MXit protocol plugin in libpurple in Pidgin before 2.10.7 allows remote servers to execute arbitrary code via a long HTTP header Affected: through 2.10.6; 2.0.0; 2.0.1; 2.0.2; 2.1.0; 2.1.1; +34 more |
| CVE-2013-0271 | – | Feb 16 | The MXit protocol plugin in libpurple in Pidgin before 2.10.7 might allow remote attackers to create or overwrite files via a crafted (1) mxit or (2) mxit/imagestrips pathname Affected: through 2.10.6; 2.0.0; 2.0.1; 2.0.2; 2.1.0; 2.1.1; +34 more |
| CVE-2011-4922 | – | Aug 8 | cipher.c in the Cipher API in libpurple in Pidgin before 2.7.10 retains encryption-key data in process memory, which might allow local users to obtain sensitive information by… Affected: through 2.7.9; 2.0.0; 2.0.1; 2.0.2; 2.1.0; 2.1.1; +34 more |
| CVE-2012-3374 | – | Jul 7 | Buffer overflow in markup.c in the MXit protocol plugin in libpurple in Pidgin before 2.10.5 allows remote attackers to execute arbitrary code via a crafted inline image in a… Affected: through 2.10.4; 2.0.0; 2.0.1; 2.0.2; 2.1.0; 2.1.1; +34 more |
| CVE-2012-2318 | – | Jul 3 | msg.c in the MSN protocol plugin in libpurple in Pidgin before 2.10.4 does not properly handle crafted characters, which allows remote servers to cause a denial of service… Affected: through 2.10.3; 2.0.0; 2.0.1; 2.0.2; 2.1.0; 2.1.1; +34 more |
| CVE-2012-2214 | – | Jul 3 | proxy.c in libpurple in Pidgin before 2.10.4 does not properly handle canceled SOCKS5 connection attempts, which allows user-assisted remote authenticated users to cause a denial… Affected: through 2.10.3; 2.0.0; 2.0.1; 2.0.2; 2.1.0; 2.1.1; +34 more |
| CVE-2012-1178 | – | Mar 15 | The msn_oim_report_to_user function in oim.c in the MSN protocol plugin in libpurple in Pidgin before 2.10.2 allows remote servers to cause a denial of service (application crash)… Affected: through 2.10.1; 2.0.0; 2.0.1; 2.0.2; 2.1.0; 2.1.1; +34 more |