CVE-2014-3698 The jabber_idn_validate function in jutil.c in the Jabber protocol plugin in libpurple in Pidgin before 2.10.10 allows remote attackers to obtain sensitive information from process memory via a crafte...
MediumCVSS 5.0
EPSS 3.8%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The jabber_idn_validate function in jutil.c in the Jabber protocol plugin in libpurple in Pidgin before 2.10.10 allows remote attackers to obtain sensitive information from process memory via a crafted XMPP message.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/pidgin(Debian:12) | < 2.10.10-1 | 2.10.10-1 |
| debian/pidgin(Debian:13) | < 2.10.10-1 | 2.10.10-1 |
| debian/pidgin(Debian:14) | < 2.10.10-1 | 2.10.10-1 |
| pidgin | <= 2.10.9 | No fix listed |
| pidgin | = 2.10.0 | No fix listed |
| pidgin | = 2.10.1 | No fix listed |
| pidgin | = 2.10.2 | No fix listed |
| pidgin | = 2.10.3 | No fix listed |
| pidgin | = 2.10.4 | No fix listed |
| pidgin | = 2.10.5 | No fix listed |
| pidgin | = 2.10.6 | No fix listed |
| pidgin | = 2.10.7 | No fix listed |
| pidgin | = 2.10.8 | No fix listed |
References
- Debian Security Tracker CVE-2014-3698 vendor-advisory
- hg.pidgin.im patch
- openSUSE-SU-2014:1376 vendor-advisory
- openSUSE-SU-2014:1397 vendor-advisory
- pidgin.im patch vendor-advisory
- 60741 third-party-advisory
- 61968 third-party-advisory
- DSA-3055 vendor-advisory
- USN-2390-1 vendor-advisory
- RHSA-2017:1854 vendor-advisory