CVE-2014-3694

Published: Oct 29, 2014Modified: May 6, 2026

6.4

Vector

AV:N/AC:L/Au:N/C:P/I:P/A:N

Exploitability: 10.0 / Impact: 4.9

Source: NVD

Description

The (1) bundled GnuTLS SSL/TLS plugin and the (2) bundled OpenSSL SSL/TLS plugin in libpurple in Pidgin before 2.10.10 do not properly consider the Basic Constraints extension during verification of X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.

Affected (17)

Products: Opensuse: Opensuse · Canonical: Ubuntu Linux · Debian: Debian Linux · +1 more

Show all products

Opensuse: Opensuse · Canonical: Ubuntu Linux · Debian: Debian Linux · Pidgin: Pidgin

1 product

1 product

1 product

1 product

Configuration A

3 vulnerable

Vulnerable Software	Affected Versions
Opensuse Opensuse	Version 12.3
Opensuse Opensuse	Version 13.1
Opensuse Opensuse	Version 13.2

Configuration B

3 vulnerable

Vulnerable Software	Affected Versions
Canonical Ubuntu Linux	Version 12.04
Canonical Ubuntu Linux	Version 14.04
Canonical Ubuntu Linux	Version 14.10

Configuration C

1 vulnerable

Vulnerable Software	Affected Versions
Debian Debian Linux	Version 7.0

Configuration D

10 vulnerable

Vulnerable Software	Affected Versions
Pidgin Pidgin	Up to 2.10.9
Pidgin Pidgin	Version 2.10.0
Pidgin Pidgin	Version 2.10.1
Pidgin Pidgin	Version 2.10.2
Pidgin Pidgin	Version 2.10.3
Pidgin Pidgin	Version 2.10.4
Pidgin Pidgin	Version 2.10.5
Pidgin Pidgin	Version 2.10.6
Pidgin Pidgin	Version 2.10.7
Pidgin Pidgin	Version 2.10.8

Related CWEs

References (18)

http://hg.pidgin.im/pidgin/main/rev/2e4475087f04

Source: secalert@redhat.com

Issue Tracking

http://lists.opensuse.org/opensuse-updates/2014-11/msg00023.html

Source: secalert@redhat.com

Third Party Advisory

http://lists.opensuse.org/opensuse-updates/2014-11/msg00037.html

Source: secalert@redhat.com

Third Party Advisory

http://pidgin.im/news/security/?id=86

Source: secalert@redhat.com

PatchVendor Advisory

http://secunia.com/advisories/60741

Source: secalert@redhat.com

http://secunia.com/advisories/61968

Source: secalert@redhat.com

http://www.debian.org/security/2014/dsa-3055

Source: secalert@redhat.com

Third Party Advisory

http://www.ubuntu.com/usn/USN-2390-1

Source: secalert@redhat.com

Third Party Advisory

https://access.redhat.com/errata/RHSA-2017:1854

Source: secalert@redhat.com

http://hg.pidgin.im/pidgin/main/rev/2e4475087f04

Source: af854a3a-2127-422b-91ae-364da2661108

Issue Tracking

http://lists.opensuse.org/opensuse-updates/2014-11/msg00023.html

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

http://lists.opensuse.org/opensuse-updates/2014-11/msg00037.html

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

http://pidgin.im/news/security/?id=86

Source: af854a3a-2127-422b-91ae-364da2661108

PatchVendor Advisory

http://secunia.com/advisories/60741

Source: af854a3a-2127-422b-91ae-364da2661108

http://secunia.com/advisories/61968

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.debian.org/security/2014/dsa-3055

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

http://www.ubuntu.com/usn/USN-2390-1

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

https://access.redhat.com/errata/RHSA-2017:1854

Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.