CVE-2014-3698

Pidgin < 2.10.10 - Information Disclosure via Crafted XMPP Message

Title source: llm
STIX 2.1

Description

The jabber_idn_validate function in jutil.c in the Jabber protocol plugin in libpurple in Pidgin before 2.10.10 allows remote attackers to obtain sensitive information from process memory via a crafted XMPP message.

References (9)

Core 9
Core References
Patch, Vendor Advisory x_refsource_confirm
http://pidgin.im/news/security/?id=90
Vendor Advisory vendor-advisory x_refsource_redhat
https://access.redhat.com/errata/RHSA-2017:1854
Vendor Advisory vendor-advisory x_refsource_ubuntu
http://www.ubuntu.com/usn/USN-2390-1
Mailing List vendor-advisory x_refsource_suse
http://lists.opensuse.org/opensuse-updates/2014-11/msg00023.html
Third Party Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/60741
Third Party Advisory vendor-advisory x_refsource_debian
http://www.debian.org/security/2014/dsa-3055
Mailing List vendor-advisory x_refsource_suse
http://lists.opensuse.org/opensuse-updates/2014-11/msg00037.html
Third Party Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/61968

Scores

EPSS 0.0378
EPSS Percentile 88.6%

Details

CWE
CWE-200
Status published
Products (10)
pidgin/pidgin 2.10.0
pidgin/pidgin 2.10.1
pidgin/pidgin 2.10.2
pidgin/pidgin 2.10.3
pidgin/pidgin 2.10.4
pidgin/pidgin 2.10.5
pidgin/pidgin 2.10.6
pidgin/pidgin 2.10.7
pidgin/pidgin 2.10.8
pidgin/pidgin < 2.10.9
Published Oct 29, 2014
Tracked Since Feb 18, 2026