Description
libpurple in Pidgin before 2.7.4 does not properly validate the return value of the purple_base64_decode function, which allows remote authenticated users to cause a denial of service (NULL pointer dereference and application crash) via a crafted message, related to the plugins for MSN, MySpaceIM, XMPP, and Yahoo! and the NTLM authentication support.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | pidgin | 2.7.4-1 | — |
| Debian 13 | pidgin | 2.7.4-1 | — |
| Debian 12 | pidgin | 2.7.4-1 | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 6 | finch +9 | 2.6.6-6.el6_0 | RHSA-2010:0890 |
| RHEL 5 | finch +8 | 2.6.6-5.el5_5 | RHSA-2010:0788 |
| RHEL 4 | finch +8 | 2.6.6-5.el4_8 | RHSA-2010:0788 |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Rhel Productivity 5 | finch +8 | 2.6.6-5.el5_5 | RHSA-2010:0788 |
Advisories 2
- RHSA-2010:0788 Red Hat Security Advisory: pidgin security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2010:0890 Red Hat Security Advisory: pidgin security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
References
- FEDORA-2010-17130 vendor-advisory
- RHSA-2010:0788 vendor-advisory
- ADV-2010-2753 vdb-entry
- pidgin-purplebase64decode-dos(62708) vdb-entry
- ADV-2010-2754 vdb-entry
- SSA:2010-305-02 vendor-advisory
- FEDORA-2010-16629 vendor-advisory
- 1024623 vdb-entry
- 44283 vdb-entry
- 42294 third-party-advisory
- 42075 third-party-advisory
- 68773 vdb-entry
- RHSA-2010:0890 vendor-advisory
- USN-1014-1 vendor-advisory
- 41893 third-party-advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=641921
- ADV-2010-2851 vdb-entry
- ADV-2010-2847 vdb-entry
- FEDORA-2010-16876 vendor-advisory
- http://developer.pidgin.im/viewmtn/revision/info/b01c6a1f7fe4d86b83f5f10917b3cb713989cfcc
- 41899 third-party-advisory
- oval:org.mitre.oval:def:18506 vdb-entry signature
- ADV-2010-2755 vdb-entry
- ADV-2010-2870 vdb-entry
- MDVSA-2010:208 vendor-advisory
- http://pidgin.im/news/security/?id=48