PI
Product
Pidgin
87
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 2High 7Medium 11Low 2
Watch
Add Pidgin to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2011-4939 | – | Mar 15 | The pidgin_conv_chat_rename_user function in gtkconv.c in Pidgin before 2.10.2 allows remote attackers to cause a denial of service (NULL pointer dereference and application… Affected: through 2.10.1; 2.0.0; 2.0.1; 2.0.2; 2.1.0; 2.1.1; +34 more |
| CVE-2011-4601 | – | Dec 25 | family_feedbag.c in the oscar protocol plugin in libpurple in Pidgin before 2.10.1 does not perform the expected UTF-8 validation on message data, which allows remote attackers to… Affected: through 2.10.0; 2.0.0; 2.0.1; 2.0.2; 2.1.0; 2.1.1; +34 more |
| CVE-2011-4603 | – | Dec 17 | The silc_channel_message function in ops.c in the SILC protocol plugin in libpurple in Pidgin before 2.10.1 does not perform the expected UTF-8 validation on message data, which… Affected: through 2.10.0; 2.0.0; 2.0.1; 2.0.2; 2.1.0; 2.1.1; +34 more |
| CVE-2011-4602 | – | Dec 17 | The XMPP protocol plugin in libpurple in Pidgin before 2.10.1 does not properly handle missing fields in (1) voice-chat and (2) video-chat stanzas, which allows remote attackers… Affected: through 2.10.0; 2.0.0; 2.0.1; 2.0.2; 2.1.0; 2.1.1; +34 more |
| CVE-2011-3594 | – | Nov 4 | The g_markup_escape_text function in the SILC protocol plug-in in libpurple 2.10.0 and earlier, as used in Pidgin and possibly other products, allows remote attackers to cause a… Affected: All versions, or not specified |
| CVE-2011-3185 | – | Aug 29 | gtkutils.c in Pidgin before 2.10.0 on Windows allows user-assisted remote attackers to execute arbitrary programs via a file: URL in a message Affected: through 2.9.0; 2.0.0; 2.0.1; 2.0.2; 2.1.0; 2.1.1; +34 more |
| CVE-2011-3184 | – | Aug 29 | The msn_httpconn_parse_data function in httpconn.c in the MSN protocol plugin in libpurple in Pidgin before 2.10.0 does not properly handle HTTP 100 responses, which allows remote… Affected: through 2.9.0; 2.0.0; 2.0.1; 2.0.2; 2.1.0; 2.1.1; +34 more |
| CVE-2011-2943 | – | Aug 29 | The irc_msg_who function in msgs.c in the IRC protocol plugin in libpurple 2.8.0 through 2.9.0 in Pidgin before 2.10.0 does not properly validate characters in nicknames, which… Affected: through 2.9.0; 2.0.0; 2.0.1; 2.0.2; 2.1.0; 2.1.1; +34 more |
| CVE-2011-1091 | – | Mar 14 | libymsg.c in the Yahoo! protocol plugin in libpurple in Pidgin 2.6.0 through 2.7.10 allows (1) remote authenticated users to cause a denial of service (NULL pointer dereference… Affected: 2.6.0; 2.6.1; 2.6.2; 2.6.4; 2.6.5; 2.6.6; +11 more |
| CVE-2010-4528 | – | Jan 7 | directconn.c in the MSN protocol plugin in libpurple 2.7.6 through 2.7.8 in Pidgin before 2.7.9 allows remote authenticated users to cause a denial of service (NULL pointer… Affected: through 2.7.8; 2.0.0; 2.0.1; 2.0.2; 2.1.0; 2.1.1; +33 more |
| CVE-2010-3711 | – | Oct 28 | libpurple in Pidgin before 2.7.4 does not properly validate the return value of the purple_base64_decode function, which allows remote authenticated users to cause a denial of… Affected: through 2.7.3; 2.0.0; 2.0.1; 2.0.2; 2.1.0; 2.1.1; +28 more |
| CVE-2010-2528 | – | Jul 30 | The clientautoresp function in family_icbm.c in the oscar protocol plugin in libpurple in Pidgin before 2.7.2 allows remote authenticated users to cause a denial of service (NULL… Affected: through 2.7.1; 2.0.0; 2.0.1; 2.0.2; 2.1.0; 2.1.1; +26 more |
| CVE-2010-1624 | – | May 14 | The msn_emoticon_msg function in slp.c in the MSN protocol plugin in libpurple in Pidgin before 2.7.0 allows remote authenticated users to cause a denial of service (NULL pointer… Affected: before 2.7.0 |
| CVE-2010-0423 | – | Feb 24 | gtkimhtml.c in Pidgin before 2.6.6 allows remote attackers to cause a denial of service (CPU consumption and application hang) by sending many smileys in a (1) IM or (2) chat Affected: through 2.6.5; 2.0.0; 2.0.1; 2.0.2; 2.1.0; 2.1.1; +23 more |
| CVE-2010-0420 | – | Feb 24 | libpurple in Finch in Pidgin before 2.6.6, when an XMPP multi-user chat (MUC) room is used, does not properly parse nicknames containing <br> sequences, which allows remote… Affected: through 2.6.5; 2.0.0; 2.0.1; 2.0.2; 2.1.0; 2.1.1; +23 more |
| CVE-2010-0277 | – | Jan 9 | slp.c in the MSN protocol plugin in libpurple in Pidgin before 2.6.6, including 2.6.4, and Adium 1.3.8 allows remote attackers to cause a denial of service (memory corruption and… Affected: through 2.6.5; 2.0.0; 2.0.1; 2.0.2; 2.1.0; 2.1.1; +23 more |
| CVE-2009-3615 | – | Oct 20 | The OSCAR protocol plugin in libpurple in Pidgin before 2.6.3 and Adium before 1.3.7 allows remote attackers to cause a denial of service (application crash) via crafted… Affected: through 2.6.2; 2.0.0; 2.0.1; 2.0.2; 2.1.0; 2.1.1; +21 more |
| CVE-2009-3085 | – | Sep 8 | The XMPP protocol plugin in libpurple in Pidgin before 2.6.2 does not properly handle an error IQ stanza during an attempted fetch of a custom smiley, which allows remote… Affected: through 2.6.1; 2.0.0; 2.0.1; 2.0.2; 2.0.2; 2.1.0; +30 more |
| CVE-2009-3084 | – | Sep 8 | The msn_slp_process_msg function in libpurple/protocols/msn/slpcall.c in the MSN protocol plugin in libpurple 2.6.0 and 2.6.1, as used in Pidgin before 2.6.2, allows remote… Affected: through 2.6.1; 2.0.0; 2.0.1; 2.0.2; 2.0.2; 2.1.0; +30 more |
| CVE-2009-3083 | – | Sep 8 | The msn_slp_sip_recv function in libpurple/protocols/msn/slp.c in the MSN protocol plugin in libpurple in Pidgin before 2.6.2 allows remote attackers to cause a denial of service… Affected: through 2.6.1; 2.0.0; 2.0.1; 2.0.2; 2.0.2; 2.1.0; +30 more |
| CVE-2009-2703 | – | Sep 8 | libpurple/protocols/irc/msgs.c in the IRC protocol plugin in libpurple in Pidgin before 2.6.2 allows remote IRC servers to cause a denial of service (NULL pointer dereference and… Affected: through 2.6.1; 2.0.0; 2.0.1; 2.0.2; 2.0.2; 2.1.0; +30 more |
| CVE-2009-3026 | – | Aug 31 | protocols/jabber/auth.c in libpurple in Pidgin 2.6.0, and possibly other versions, does not follow the "require TLS/SSL" preference when connecting to older Jabber servers that do… Affected: 2.6.0 |
| CVE-2009-3025 | – | Aug 31 | Unspecified vulnerability in Pidgin 2.6.0 allows remote attackers to cause a denial of service (crash) via a link in a Yahoo IM Affected: 2.6.0 |
| CVE-2009-2694 | – | Aug 21 | The msn_slplink_process_msg function in libpurple/protocols/msn/slplink.c in libpurple, as used in Pidgin (formerly Gaim) before 2.5.9 and Adium 1.3.5 and earlier, allows remote… Affected: through 2.5.8; 2.0.0; 2.0.1; 2.0.2; 2.1.0; 2.1.1; +16 more |
| CVE-2009-1889 | – | Jul 1 | The OSCAR protocol implementation in Pidgin before 2.5.8 misinterprets the ICQWebMessage message type as the ICQSMS message type, which allows remote attackers to cause a denial… Affected: through 2.5.7; 2.0.0; 2.0.1; 2.0.2; 2.0.2; 2.1.0; +20 more |
| CVE-2009-1376 | – | May 26 | Multiple integer overflows in the msn_slplink_process_msg functions in the MSN protocol handler in (1) libpurple/protocols/msn/slplink.c and (2)… Affected: through 2.5.5; 2.4.0; 2.4.1; 2.4.2; 2.4.3; 2.5.0; +3 more |
| CVE-2009-1375 | – | May 26 | The PurpleCircBuffer implementation in Pidgin (formerly Gaim) before 2.5.6 does not properly maintain a certain buffer, which allows remote attackers to cause a denial of service… Affected: through 2.5.5; 2.0.0; 2.0.1; 2.0.2; 2.0.2; 2.1.0; +15 more |
| CVE-2009-1374 | – | May 26 | Buffer overflow in the decrypt_out function in Pidgin (formerly Gaim) before 2.5.6 allows remote attackers to cause a denial of service (application crash) via a QQ packet Affected: through 2.5.5; 2.0.0; 2.0.1; 2.0.2; 2.0.2; 2.1.0; +15 more |
| CVE-2009-1373 | – | May 26 | Buffer overflow in the XMPP SOCKS5 bytestream server in Pidgin (formerly Gaim) before 2.5.6 allows remote authenticated users to execute arbitrary code via vectors involving an… Affected: through 2.5.5; 2.0.0; 2.0.1; 2.0.2; 2.0.2; 2.1.0; +15 more |
| CVE-2008-3532 | – | Aug 8 | The NSS plugin in libpurple in Pidgin 2.4.3 does not verify SSL certificates, which makes it easier for remote attackers to trick a user into accepting an invalid server… Affected: 2.4.3 |
| CVE-2008-2927 | – | Jul 7 | Multiple integer overflows in the msn_slplink_process_msg functions in the MSN protocol handler in (1) libpurple/protocols/msn/slplink.c and (2)… Affected: through 2.4.2; 2.0.0; 2.0.1; 2.0.2; 2.1.0; 2.1.1; +7 more |
| CVE-2008-2955 | – | Jul 1 | Pidgin 2.4.1 allows remote attackers to cause a denial of service (crash) via a long filename that contains certain characters, as demonstrated using an MSN message that triggers… Affected: 2.4.1 |
| CVE-2008-2957 | – | Jul 1 | The UPnP functionality in Pidgin 2.0.0, and possibly other versions, allows remote attackers to trigger the download of arbitrary files and cause a denial of service (memory or… Affected: 2.0.0 |
| CVE-2008-2956 | – | Jul 1 | Memory leak in Pidgin 2.0.0, and possibly other versions, allows remote attackers to cause a denial of service (memory consumption) via malformed XML documents Affected: 2.0.0 |
| CVE-2007-4999 | – | Oct 29 | libpurple in Pidgin 2.1.0 through 2.2.1, when using HTML logging, allows remote attackers to cause a denial of service (NULL dereference and application crash) via a message that… Affected: 2.1.0; 2.2.0; 2.2.1 |
| CVE-2007-4996 | – | Oct 1 | libpurple in Pidgin before 2.2.1 does not properly handle MSN nudge messages from users who are not on the receiver's buddy list, which allows remote attackers to cause a denial… Affected: 2.2.0 |
| CVE-2007-3841 | – | Jul 17 | Unspecified vulnerability in Pidgin (formerly Gaim) 2.0.2 for Linux allows remote authenticated users, who are listed in a users list, to execute certain commands via unspecified… Affected: 2.0.2 |