CVSS: 4.3EPSS: 0%CPEs: 5EXPL: 0CVE-2016-2380
https://notcve.org/view.php?id=CVE-2016-2380
An information leak exists in the handling of the MXIT protocol in Pidgin. Specially crafted MXIT data sent to the server could potentially result in an out-of-bounds read. A user could be convinced to enter a particular string which would then get converted incorrectly and could lead to a potential out-of-bounds read. Existe una fuga de información en el manejo del protocolo MXIT en Pidgin.Datos MXIT expecialmente manipulados enviados al servidor podrían resultar potencialmente en una lectura fuera de límites. Un usuario podría ser convencido para introducir una cadena particular que podría entonces ser convertida de forma incorrecta y conducir a una potencial lectura fuera de límites. • http://www.debian.org/security/2016/dsa-3620 http://www.pidgin.im/news/security/?id=96 http://www.securityfocus.com/bid/91335 http://www.talosintelligence.com/reports/TALOS-2016-0123 http://www.ubuntu.com/usn/USN-3031-1 https://security.gentoo.org/glsa/201701-38 • CWE-125: Out-of-bounds Read CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 6.4EPSS: 0%CPEs: 10EXPL: 0CVE-2014-3697
https://notcve.org/view.php?id=CVE-2014-3697
Absolute path traversal vulnerability in the untar_block function in win32/untar.c in Pidgin before 2.10.10 on Windows allows remote attackers to write to arbitrary files via a drive name in a tar archive of a smiley theme. Vulnerabilidad de salto de ruta absoluta en la función untar_block en win32/untar.c en Pidgin anterior a 2.10.10 en Windows permite a atacantes remotos escribir a ficheros arbitrarios a través de un nombre drive en un archivo tar de un tema smiley. • http://hg.pidgin.im/pidgin/main/rev/68b8eb10977f http://lists.opensuse.org/opensuse-updates/2014-11/msg00023.html http://lists.opensuse.org/opensuse-updates/2014-11/msg00037.html http://pidgin.im/news/security/?id=89 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 5.0EPSS: 1%CPEs: 10EXPL: 0CVE-2014-3695 – pidgin: crash in Mxit protocol plug-in
https://notcve.org/view.php?id=CVE-2014-3695
markup.c in the MXit protocol plugin in libpurple in Pidgin before 2.10.10 allows remote servers to cause a denial of service (application crash) via a large length value in an emoticon response. markup.c en el plugin de protocolo MXit en libpurple en Pidgin anterior a 2.10.10 permite a servidores remotos causar una denegación de servicio (caída de aplicación) a través de un valor grande de longitud en una respuesta emoticon. A denial of service flaw was found in the way Pidgin's Mxit plug-in handled emoticons. A malicious remote server or a man-in-the-middle attacker could potentially use this flaw to crash Pidgin by sending a specially crafted emoticon. • http://hg.pidgin.im/pidgin/main/rev/6436e14bdb9d http://lists.opensuse.org/opensuse-updates/2014-11/msg00023.html http://lists.opensuse.org/opensuse-updates/2014-11/msg00037.html http://pidgin.im/news/security/?id=87 http://secunia.com/advisories/60741 http://secunia.com/advisories/61968 http://www.debian.org/security/2014/dsa-3055 http://www.ubuntu.com/usn/USN-2390-1 https://access.redhat.com/errata/RHSA-2017:1854 https://access.redhat.com/security/cve/CVE-201 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 5.0EPSS: 1%CPEs: 10EXPL: 0CVE-2014-3696 – pidgin: denial of service parsing Groupwise server message
https://notcve.org/view.php?id=CVE-2014-3696
nmevent.c in the Novell GroupWise protocol plugin in libpurple in Pidgin before 2.10.10 allows remote servers to cause a denial of service (application crash) via a crafted server message that triggers a large memory allocation. nmevent.c en el plugin del protocolo Novell GroupWise en libpurple en Pidgin anterior a 2.10.10 permite a servidores remotos causar una denegación de servicio (caída de aplicación) a través de un mensaje del servidor manipulado que provoca una reserva grande de memoria. A denial of service flaw was found in the way Pidgin parsed Groupwise server messages. A malicious remote server or a man-in-the-middle attacker could potentially use this flaw to cause Pidgin to consume an excessive amount of memory, possibly leading to a crash, by sending a specially crafted message. • http://hg.pidgin.im/pidgin/main/rev/44fd89158777 http://lists.opensuse.org/opensuse-updates/2014-11/msg00023.html http://lists.opensuse.org/opensuse-updates/2014-11/msg00037.html http://pidgin.im/news/security/?id=88 http://secunia.com/advisories/60741 http://secunia.com/advisories/61968 http://www.debian.org/security/2014/dsa-3055 http://www.ubuntu.com/usn/USN-2390-1 https://access.redhat.com/errata/RHSA-2017:1854 https://access.redhat.com/security/cve/CVE-201 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer CWE-770: Allocation of Resources Without Limits or Throttling •
CVSS: 6.4EPSS: 0%CPEs: 17EXPL: 0CVE-2014-3694 – pidgin: SSL/TLS plug-ins failed to check Basic Constraints
https://notcve.org/view.php?id=CVE-2014-3694
The (1) bundled GnuTLS SSL/TLS plugin and the (2) bundled OpenSSL SSL/TLS plugin in libpurple in Pidgin before 2.10.10 do not properly consider the Basic Constraints extension during verification of X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate. (1) El plugin bundled GnuTLS SSL/TLS y (2) el plugin bundled OpenSSL SSL/TLS en libpurple en Pidgin anterior a 2.10.10 no consideran debidamente la extensión Basic Constraints durante la verificación de los certificados X.509 de los servidores SSL, lo que permite a atacantes man-in-the-middle suplantar servidores y obtener información sensible a través de un certificado manipulado. It was found that Pidgin's SSL/TLS plug-ins had a flaw in the certificate validation functionality. An attacker could use this flaw to create a fake certificate, that Pidgin would trust, which could be used to conduct man-in-the-middle attacks against Pidgin. • http://hg.pidgin.im/pidgin/main/rev/2e4475087f04 http://lists.opensuse.org/opensuse-updates/2014-11/msg00023.html http://lists.opensuse.org/opensuse-updates/2014-11/msg00037.html http://pidgin.im/news/security/?id=86 http://secunia.com/advisories/60741 http://secunia.com/advisories/61968 http://www.debian.org/security/2014/dsa-3055 http://www.ubuntu.com/usn/USN-2390-1 https://access.redhat.com/errata/RHSA-2017:1854 https://access.redhat.com/security/cve/CVE-201 • CWE-295: Improper Certificate Validation CWE-310: Cryptographic Issues •