Description
libymsg.c in the Yahoo! protocol plugin in libpurple in Pidgin 2.6.0 through 2.7.10 allows (1) remote authenticated users to cause a denial of service (NULL pointer dereference and application crash) via a malformed YMSG notification packet, and allows (2) remote Yahoo! servers to cause a denial of service (NULL pointer dereference and application crash) via a malformed YMSG SMS message.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | pidgin | 2.7.11-1 | — |
| Debian 13 | pidgin | 2.7.11-1 | — |
| Debian 12 | pidgin | 2.7.11-1 | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 6 | finch +9 | 2.7.9-3.el6 | RHSA-2011:0616 |
| RHEL 5 | finch +8 | 2.6.6-5.el5_7.1 | RHSA-2011:1371 |
| RHEL 4 | finch +8 | 2.6.6-7.el4 | RHSA-2011:1371 |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Rhel Productivity 5 | finch +8 | 2.6.6-5.el5_7.1 | RHSA-2011:1371 |
Advisories 2
- RHSA-2011:1371 Red Hat Security Advisory: pidgin security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2011:0616 Red Hat Security Advisory: pidgin security and bug fix update Red Hat Security Advisories (RHSA) · Jun 26, 2026
References
- ADV-2011-0661 vdb-entry
- RHSA-2011:0616 vendor-advisory
- openSUSE-SU-2012:0066 vendor-advisory
- http://developer.pidgin.im/viewmtn/revision/diff/5cbe18129b6e7c660bc093f7e5e1414ceca17d04/with/a7c415abba1f5f01f79295337518837f73d99bb7/libpurple/protocols/yahoo/libymsg.c
- http://www.pidgin.im/news/security/?id=51
- 46837 vdb-entry
- https://bugzilla.redhat.com/show_bug.cgi?id=683031
- ADV-2011-0703 vdb-entry
- FEDORA-2011-3150 vendor-advisory
- 43721 third-party-advisory
- SSA:2011-070-02 vendor-advisory
- pidgin-yahoo-protocol-dos(66055) vdb-entry
- 46376 third-party-advisory
- 43695 third-party-advisory
- RHSA-2011:1371 vendor-advisory
- oval:org.mitre.oval:def:18402 vdb-entry signature
- ADV-2011-0669 vdb-entry
- http://developer.pidgin.im/viewmtn/revision/info/a7c415abba1f5f01f79295337518837f73d99bb7
- FEDORA-2011-3113 vendor-advisory
- ADV-2011-0643 vdb-entry