Description
The XMPP protocol plugin in libpurple in Pidgin before 2.6.2 does not properly handle an error IQ stanza during an attempted fetch of a custom smiley, which allows remote attackers to cause a denial of service (application crash) via XHTML-IM content with cid: images.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | pidgin | 2.6.2-1 | — |
| Debian 13 | pidgin | 2.6.2-1 | — |
| Debian 12 | pidgin | 2.6.2-1 | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 5 | finch +8 | 2.6.2-2.el5 | RHSA-2009:1453 |
| RHEL 4 | finch +8 | 2.6.2-2.el4 | RHSA-2009:1453 |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Rhel Productivity 5 | finch +8 | 2.6.2-2.el5 | RHSA-2009:1453 |
Advisories 1
- RHSA-2009:1453 Red Hat Security Advisory: pidgin security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
References
- 36601 third-party-advisory
- http://developer.pidgin.im/viewmtn/revision/info/fd5955618eddcd84d522b30ff11102f9601f38c8
- http://www.pidgin.im/news/security/index.php?id=37
- 36277 vdb-entry
- oval:org.mitre.oval:def:6434 vdb-entry signature
- oval:org.mitre.oval:def:11223 vdb-entry signature