Description
The PurpleCircBuffer implementation in Pidgin (formerly Gaim) before 2.5.6 does not properly maintain a certain buffer, which allows remote attackers to cause a denial of service (memory corruption and application crash) via vectors involving the (1) XMPP or (2) Sametime protocol.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | pidgin | 2.5.6-1 | — |
| Debian 13 | pidgin | 2.5.6-1 | — |
| Debian 12 | pidgin | 2.5.6-1 | — |
| Debian 5.0 | pidgin | 2.4.3-4lenny2 | DSA-1805-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 5 | finch +8 | 2.5.5-3.el5 | RHSA-2009:1060 |
| RHEL 4 | finch +8 | 2.5.5-2.el4 | RHSA-2009:1060 |
Advisories 2
- RHSA-2009:1060 Red Hat Security Advisory: pidgin security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- DSA-1805-1 pidgin - several vulnerabilities Debian Security (DSA / DLA) · Mar 9, 2026
References
- FEDORA-2009-5597 vendor-advisory
- RHSA-2009:1060 vendor-advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=500491
- GLSA-200905-07 vendor-advisory
- 35067 vdb-entry
- FEDORA-2009-5583 vendor-advisory
- 35329 third-party-advisory
- USN-781-1 vendor-advisory
- 54649 vdb-entry
- DSA-1805 vendor-advisory
- 35294 third-party-advisory
- 35188 third-party-advisory
- oval:org.mitre.oval:def:10829 vdb-entry signature
- 35194 third-party-advisory
- FEDORA-2009-5552 vendor-advisory
- 35202 third-party-advisory
- 35215 third-party-advisory
- ADV-2009-1396 vdb-entry
- http://www.pidgin.im/news/security/?id=31
- pidgin-purplecircbuffer-dos(50683) vdb-entry
- MDVSA-2009:173 vendor-advisory