CVE-2014-3696 nmevent.c in the Novell GroupWise protocol plugin in libpurple in Pidgin before 2.10.10 allows remote servers to cause a denial of service (application crash) via a crafted server message that trigger...
MediumCVSS 5.0
EPSS 2.9%
- Published
- Updated
- Exploit status
- No public exploit known
Description
nmevent.c in the Novell GroupWise protocol plugin in libpurple in Pidgin before 2.10.10 allows remote servers to cause a denial of service (application crash) via a crafted server message that triggers a large memory allocation.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/pidgin(Debian:12) | < 2.10.10-1 | 2.10.10-1 |
| debian/pidgin(Debian:13) | < 2.10.10-1 | 2.10.10-1 |
| debian/pidgin(Debian:14) | < 2.10.10-1 | 2.10.10-1 |
| pidgin | <= 2.10.9 | No fix listed |
| pidgin | = 2.10.0 | No fix listed |
| pidgin | = 2.10.1 | No fix listed |
| pidgin | = 2.10.2 | No fix listed |
| pidgin | = 2.10.3 | No fix listed |
| pidgin | = 2.10.4 | No fix listed |
| pidgin | = 2.10.5 | No fix listed |
| pidgin | = 2.10.6 | No fix listed |
| pidgin | = 2.10.7 | No fix listed |
| pidgin | = 2.10.8 | No fix listed |
References
- Debian Security Tracker CVE-2014-3696 vendor-advisory
- hg.pidgin.im patch
- openSUSE-SU-2014:1376 vendor-advisory
- openSUSE-SU-2014:1397 vendor-advisory
- pidgin.im patch vendor-advisory
- 60741 third-party-advisory
- 61968 third-party-advisory
- DSA-3055 vendor-advisory
- USN-2390-1 vendor-advisory
- RHSA-2017:1854 vendor-advisory