CVSS: 5.9EPSS: 0%CPEs: 2EXPL: 0CVE-2022-26491
https://notcve.org/view.php?id=CVE-2022-26491
An issue was discovered in Pidgin before 2.14.9. A remote attacker who can spoof DNS responses can redirect a client connection to a malicious server. The client will perform TLS certificate verification of the malicious domain name instead of the original XMPP service domain, allowing the attacker to take over control over the XMPP connection and to obtain user credentials and all communication content. This is similar to CVE-2022-24968. Se ha detectado un problema en Pidgin versiones anteriores a 2.14.9. • https://developer.pidgin.im/wiki/FullChangeLog https://github.com/xsf/xeps/pull/1158 https://keep.imfreedom.org/pidgin/pidgin/rev/13cdb7956bdc https://lists.debian.org/debian-lts-announce/2022/06/msg00005.html https://mail.jabber.org/pipermail/standards/2022-February/038759.html https://pidgin.im/about/security/advisories/cve-2022-26491 • CWE-295: Improper Certificate Validation •
CVSS: 5.5EPSS: 0%CPEs: 1EXPL: 1CVE-2012-1257 – libpurple 2.8.10 - OTR Information Disclosure
https://notcve.org/view.php?id=CVE-2012-1257
Pidgin 2.10.0 uses DBUS for certain cleartext communication, which allows local users to obtain sensitive information via a dbus session monitor. Pidgin versión 2.10.0, usa DBUS para ciertas comunicaciones de texto sin cifrar, lo que permite a usuarios locales obtener información confidencial por medio de un monitor de sesión dbus. • https://www.exploit-db.com/exploits/36884 http://developer.pidgin.im/ticket/14830 http://pidgin.im/pipermail/devel/2011-December/010521.html • CWE-319: Cleartext Transmission of Sensitive Information •
CVSS: 9.8EPSS: 0%CPEs: 8EXPL: 0CVE-2017-2640 – pidgin: Out-of-bounds write in purple_markup_unescape_entity triggered by invalid XML
https://notcve.org/view.php?id=CVE-2017-2640
An out-of-bounds write flaw was found in the way Pidgin before 2.12.0 processed XML content. A malicious remote server could potentially use this flaw to crash Pidgin or execute arbitrary code in the context of the pidgin process. Se ha encontrado una vulnerabilidad de escritura fuera de límites en el modo en que Pidgin en versiones anteriores a la 2.12.0 procesaba el contenido XML. Un servidor remoto malicioso podría usar esta vulnerabilidad para provocar el cierre inesperado de Pidgin o ejecutar código arbitrario en el contexto del proceso pidgin. An out-of-bounds write flaw was found in the way Pidgin processed XML content. • http://www.securityfocus.com/bid/96775 https://access.redhat.com/errata/RHSA-2017:1854 https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-2640 https://security.gentoo.org/glsa/201706-10 https://www.debian.org/security/2017/dsa-3806 https://access.redhat.com/security/cve/CVE-2017-2640 https://bugzilla.redhat.com/show_bug.cgi?id=1430019 • CWE-787: Out-of-bounds Write •
CVSS: 9.8EPSS: 0%CPEs: 2EXPL: 0CVE-2016-1000030
https://notcve.org/view.php?id=CVE-2016-1000030
Pidgin version <2.11.0 contains a vulnerability in X.509 Certificates imports specifically due to improper check of return values from gnutls_x509_crt_init() and gnutls_x509_crt_import() that can result in code execution. This attack appear to be exploitable via custom X.509 certificate from another client. This vulnerability appears to have been fixed in 2.11.0. Pidgin en versiones anteriores a la 2.11.0 contiene una vulnerabilidad en las importaciones de certificados X.509, concretamente debido a la comprobación incorrecta de valores de retorno de gnutls_x509_crt_init() y gnutls_x509_crt_import() que puede resultar en la ejecución de código. Este ataque parece ser explotable mediante un certificado X.509 personalizado de otro cliente. • https://access.redhat.com/security/cve/cve-2016-1000030 https://bitbucket.org/pidgin/main/commits/d6fc1ce76ffe https://pidgin.im/news/security/?id=91 https://security.gentoo.org/glsa/201701-38 https://www.suse.com/pt-br/security/cve/CVE-2016-1000030 • CWE-295: Improper Certificate Validation •
CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 0CVE-2016-2379
https://notcve.org/view.php?id=CVE-2016-2379
The Mxit protocol uses weak encryption when encrypting user passwords, which might allow attackers to (1) decrypt hashed passwords by leveraging knowledge of client registration codes or (2) gain login access by eavesdropping on login messages and re-using the hashed passwords. El protocolo Mxit utiliza cifrado débil al cifrar contraseñas de usuario, lo que podría permitir a atacantes (1) Descifrar contraseñas hash aprovechando el conocimiento de los códigos de registro del cliente u (2) obtener acceso de acceso por escuchas en los mensajes de inicio de sesión y volver a utilizar las contraseñas hash. • http://www.securityfocus.com/bid/91335 http://www.talosintelligence.com/reports/TALOS-2016-0122 https://pidgin.im/news/security/?id=95 https://security.gentoo.org/glsa/201701-38 • CWE-326: Inadequate Encryption Strength •