Description
libpurple in Pidgin 2.1.0 through 2.2.1, when using HTML logging, allows remote attackers to cause a denial of service (NULL dereference and application crash) via a message that contains invalid HTML data, a different vector than CVE-2007-4996.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | pidgin | 2.2.2-1 | — |
| Debian 13 | pidgin | 2.2.2-1 | — |
| Debian 12 | pidgin | 2.2.2-1 | — |
References
- 26205 vdb-entry
- http://www.pidgin.im/news/security/?id=24
- ADV-2007-3624 vdb-entry
- oval:org.mitre.oval:def:18357 vdb-entry signature
- 38695 vdb-entry
- pidgin-htmldata-dos(38132) vdb-entry
- 27495 third-party-advisory
- FEDORA-2007-2714 vendor-advisory
- 20071112 FLEA-2007-0067-1 pidgin mailing-list
- 27372 third-party-advisory
- 27858 third-party-advisory
- USN-548-1 vendor-advisory