Input validation error in Pidgin - CVE-2014-0020
Published: February 6, 2014 / Updated: August 10, 2020
Vulnerability identifier: #VU42062
CSH Severity: Medium
CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
CVE-ID: CVE-2014-0020
CWE-ID: CWE-20
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote non-authenticated attacker to perform service disruption.
The IRC protocol plugin in libpurple in Pidgin before 2.10.8 does not validate argument counts, which allows remote IRC servers to cause a denial of service (application crash) via a crafted message.
Affected software
Pidgin
Gentoo Linux
Ubuntu
Slackware Linux
libpurple0 (Ubuntu package)
pidgin (Ubuntu package)
Gentoo Linux
Ubuntu
Slackware Linux
libpurple0 (Ubuntu package)
pidgin (Ubuntu package)
How to mitigate CVE-2014-0020
Install update from vendor's website.
libpurple0 (Ubuntu package) - addressed in versions 1:2.10.3-0ubuntu1.4, 1:2.10.6-0ubuntu2.3, 1:2.10.7-0ubuntu4.1.13.10.1
pidgin (Ubuntu package) - addressed in versions 1:2.10.3-0ubuntu1.4, 1:2.10.6-0ubuntu2.3, 1:2.10.7-0ubuntu4.1.13.10.1
pidgin (Ubuntu package) - addressed in versions 1:2.10.3-0ubuntu1.4, 1:2.10.6-0ubuntu2.3, 1:2.10.7-0ubuntu4.1.13.10.1
External References
- http://hg.pidgin.im/pidgin/main/rev/4d9be297d399
- http://hg.pidgin.im/pidgin/main/rev/5845d9fa7084
- http://hg.pidgin.im/pidgin/main/rev/6b0e0566af20
- http://hg.pidgin.im/pidgin/main/rev/7d0fb0c6d8d4
- http://hg.pidgin.im/pidgin/main/rev/9f132a6855cd
- http://hg.pidgin.im/pidgin/main/rev/a167504359e5
- http://lists.opensuse.org/opensuse-updates/2014-02/msg00039.html
- http://lists.opensuse.org/opensuse-updates/2014-03/msg00005.html
- http://pidgin.im/news/security/?id=85
- http://www.debian.org/security/2014/dsa-2859
- http://www.ubuntu.com/usn/USN-2100-1
- https://rhn.redhat.com/errata/RHSA-2014-0139.html