CVE-2010-3711

Published: Oct 28, 2010Modified: Apr 29, 2026

4.0

Vector

AV:N/AC:L/Au:S/C:N/I:N/A:P

Exploitability: 8.0 / Impact: 2.9

Source: NVD

Description

libpurple in Pidgin before 2.7.4 does not properly validate the return value of the purple_base64_decode function, which allows remote authenticated users to cause a denial of service (NULL pointer dereference and application crash) via a crafted message, related to the plugins for MSN, MySpaceIM, XMPP, and Yahoo! and the NTLM authentication support.

Affected (34)

Products: Pidgin: Pidgin

Pidgin

1 product

Pidgin

Configuration A

34 vulnerable

Vulnerable Software	Affected Versions
Pidgin Pidgin	Up to 2.7.3
Pidgin Pidgin	Version 2.0.0
Pidgin Pidgin	Version 2.0.1
Pidgin Pidgin	Version 2.0.2
Pidgin Pidgin	Version 2.1.0
Pidgin Pidgin	Version 2.1.1
Pidgin Pidgin	Version 2.2.0
Pidgin Pidgin	Version 2.2.1
Pidgin Pidgin	Version 2.2.2
Pidgin Pidgin	Version 2.3.0
Pidgin Pidgin	Version 2.3.1
Pidgin Pidgin	Version 2.4.0
Pidgin Pidgin	Version 2.4.1
Pidgin Pidgin	Version 2.4.2
Pidgin Pidgin	Version 2.4.3
Pidgin Pidgin	Version 2.5.0
Pidgin Pidgin	Version 2.5.1
Pidgin Pidgin	Version 2.5.2
Pidgin Pidgin	Version 2.5.3
Pidgin Pidgin	Version 2.5.4
Pidgin Pidgin	Version 2.5.5
Pidgin Pidgin	Version 2.5.6
Pidgin Pidgin	Version 2.5.7
Pidgin Pidgin	Version 2.5.8
Pidgin Pidgin	Version 2.5.9
Pidgin Pidgin	Version 2.6.0
Pidgin Pidgin	Version 2.6.1
Pidgin Pidgin	Version 2.6.2
Pidgin Pidgin	Version 2.6.4
Pidgin Pidgin	Version 2.6.5
Pidgin Pidgin	Version 2.6.6
Pidgin Pidgin	Version 2.7.0
Pidgin Pidgin	Version 2.7.1
Pidgin Pidgin	Version 2.7.2

Related CWEs

CWE-20

Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

References (52)

http://developer.pidgin.im/viewmtn/revision/info/b01c6a1f7fe4d86b83f5f10917b3cb713989cfcc

Source: secalert@redhat.com

Patch

http://lists.fedoraproject.org/pipermail/package-announce/2010-November/050227.html

Source: secalert@redhat.com

http://lists.fedoraproject.org/pipermail/package-announce/2010-November/050695.html

Source: secalert@redhat.com

http://lists.fedoraproject.org/pipermail/package-announce/2010-October/050133.html

Source: secalert@redhat.com

http://pidgin.im/news/security/?id=48

Source: secalert@redhat.com

PatchVendor Advisory

http://secunia.com/advisories/41893

Source: secalert@redhat.com

Vendor Advisory

http://secunia.com/advisories/41899

Source: secalert@redhat.com

Vendor Advisory

http://secunia.com/advisories/42075

Source: secalert@redhat.com

http://secunia.com/advisories/42294

Source: secalert@redhat.com

http://securitytracker.com/id?1024623

Source: secalert@redhat.com

http://slackware.com/security/viewer.php?l=slackware-security&y=2010&m=slackware-security.462352

Source: secalert@redhat.com

http://www.mandriva.com/security/advisories?name=MDVSA-2010:208

Source: secalert@redhat.com

http://www.osvdb.org/68773

Source: secalert@redhat.com

http://www.redhat.com/support/errata/RHSA-2010-0788.html

Source: secalert@redhat.com

http://www.redhat.com/support/errata/RHSA-2010-0890.html

Source: secalert@redhat.com

http://www.securityfocus.com/bid/44283

Source: secalert@redhat.com

http://www.ubuntu.com/usn/USN-1014-1

Source: secalert@redhat.com

http://www.vupen.com/english/advisories/2010/2753

Source: secalert@redhat.com

PatchVendor Advisory

http://www.vupen.com/english/advisories/2010/2754

Source: secalert@redhat.com

Vendor Advisory

http://www.vupen.com/english/advisories/2010/2755

Source: secalert@redhat.com

Vendor Advisory

http://www.vupen.com/english/advisories/2010/2847

Source: secalert@redhat.com

http://www.vupen.com/english/advisories/2010/2851

Source: secalert@redhat.com

http://www.vupen.com/english/advisories/2010/2870

Source: secalert@redhat.com

https://bugzilla.redhat.com/show_bug.cgi?id=641921

Source: secalert@redhat.com

https://exchange.xforce.ibmcloud.com/vulnerabilities/62708

Source: secalert@redhat.com

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A18506

Source: secalert@redhat.com

http://developer.pidgin.im/viewmtn/revision/info/b01c6a1f7fe4d86b83f5f10917b3cb713989cfcc