debian/libgadu vulnerabilities

Latest debian/libgadu CVEs

Newest publication first

1. CVE-2013-4488 libgadu before 1.12.0 does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers.

   Published 2014-10-10

   Medium·CVSS 4.3 EPSS 1.1%

   libgadu before 1.12.0 does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers.

2. CVE-2014-3775 libgadu before 1.11.4 and 1.12.0 before 1.12.0-rc3, as used in Pidgin and other products, allows remote Gadu-Gadu file relay servers to cause a denial of service (memory overwrite) or possibly execute...

   Published 2014-05-22

   High·CVSS 7.5 EPSS 3.8%

   libgadu before 1.11.4 and 1.12.0 before 1.12.0-rc3, as used in Pidgin and other products, allows remote Gadu-Gadu file relay servers to cause a denial of service (memory overwrite) or possibly execute arbitrary code via a crafted message.

3. DSA-2935-1 libgadu - security update

   Published 2014-05-21

   Unknown

4. CVE-2013-6487 Integer overflow in libpurple/protocols/gg/lib/http.c in the Gadu-Gadu (gg) parser in Pidgin before 2.10.8 allows remote attackers to have an unspecified impact via a large Content-Length value, which...

   Published 2014-02-06

   High·CVSS 7.5 EPSS 8.2%

   Integer overflow in libpurple/protocols/gg/lib/http.c in the Gadu-Gadu (gg) parser in Pidgin before 2.10.8 allows remote attackers to have an unspecified impact via a large Content-Length value, which triggers a buffer overflow.

5. DSA-2852-1 libgadu - heap-based buffer overflow

   Published 2014-02-03

   Unknown

6. CVE-2008-4776 libgadu before 1.8.2 allows remote servers to cause a denial of service (crash) via a contact description with a large length, which triggers a buffer over-read.

   Published 2008-10-28

   Medium·CVSS 4.3 EPSS 1.3%

   libgadu before 1.8.2 allows remote servers to cause a denial of service (crash) via a contact description with a large length, which triggers a buffer over-read.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.