CVE-2010-0423

Description

gtkimhtml.c in Pidgin before 2.6.6 allows remote attackers to cause a denial of service (CPU consumption and application hang) by sending many smileys in a (1) IM or (2) chat.

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗

Release	Package	Fixed in	Advisory
Debian 14	pidgin	2.6.6-1	—
Debian 13	pidgin	2.6.6-1	—
Debian 12	pidgin	2.6.6-1	—
Debian 5.0	pidgin	2.4.3-4lenny6	DSA-2038-1

Red Hat

Security tracker ↗

Release	Package	Fixed in	Advisory
RHEL 5	finch +8	2.6.6-1.el5	RHSA-2010:0115
RHEL 4	finch +8	2.6.6-1.el4	RHSA-2010:0115

Show 1 more (older releases, extended support, other products)

Release	Package	Fixed in	Advisory
Red Hat Rhel Productivity 5	finch +8	2.6.6-1.el5	RHSA-2010:0115

Advisories 2

RHSA-2010:0115 Red Hat Security Advisory: pidgin security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
DSA-2038-1 pidgin - denial of service Debian Security (DSA / DLA) · Mar 9, 2026

References

FEDORA-2010-1279 vendor-advisory
38294 vdb-entry
RHSA-2010:0115 vendor-advisory
62440 vdb-entry
ADV-2010-0413 vdb-entry
38563 third-party-advisory
MDVSA-2010:085 vendor-advisory
USN-902-1 vendor-advisory
38640 third-party-advisory
ADV-2010-0914 vdb-entry
38658 third-party-advisory
oval:org.mitre.oval:def:9842 vdb-entry signature
http://pidgin.im/news/security/?id=45
FEDORA-2010-1934 vendor-advisory
ADV-2010-1020 vdb-entry
SUSE-SR:2010:006 vendor-advisory
FEDORA-2010-1383 vendor-advisory
DSA-2038 vendor-advisory
38712 third-party-advisory
https://bugzilla.redhat.com/show_bug.cgi?id=565792
pidgin-smileys-dos(56394) vdb-entry
oval:org.mitre.oval:def:17554 vdb-entry signature
39509 third-party-advisory
MDVSA-2010:041 vendor-advisory
38915 third-party-advisory
http://developer.pidgin.im/wiki/ChangeLog