Denial of Service in Pidgin XMPP Protocol Plugin
Summary
CVE-2011-4602: The XMPP protocol plugin in libpurple in Pidgin before 2.10.1 does not properly handle missing fields in (1) voice-chat and (2) video-chat stanzas, which allows remote attackers to cause a denial of service (application... Affects pidgin versions < 2.10.1-1. Fixed in 2.10.1-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Pidgin is an open-source instant messaging client that supports multiple chat protocols. It allows users to communicate with contacts on various platforms, including XMPP (Extensible Messaging and Presence Protocol). The XMPP protocol plugin in Pidgin handles voice and video chat functionalities. However, prior to version 2.10.1, Pidgin's XMPP plugin did not handle missing fields in voice-chat and video-chat stanzas properly.
Vulnerability Detail
The vulnerability, identified as CVE-2011-4602, allows remote attackers to cause a denial of service (application crash) by sending a crafted message to Pidgin. When the XMPP plugin receives a message with missing fields in voice-chat or video-chat stanzas, it fails to handle them correctly. This flaw can be exploited by an attacker to crash the application, disrupting the communication of legitimate users.
How To Fix
Minimum fixed version
2.10.1-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade pidginTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround available for this vulnerability. It is advised to apply the fix by updating Pidgin to the latest version.
Conclusion
The vulnerability in Pidgin's XMPP protocol plugin can be exploited by remote attackers to cause a denial of service. To mitigate this risk, users should update Pidgin to version 2.10.1 or later. For further assistance or support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for pidgin →
FAQ
Pidgin is an open-source instant messaging client that supports multiple chat protocols.
XMPP (Extensible Messaging and Presence Protocol) is a communication protocol used for instant messaging and presence information.
The vulnerability allows remote attackers to crash the Pidgin application, causing a denial of service and disrupting communication.
To fix this vulnerability, update Pidgin to version 2.10.1 or later.
No, there is no specific workaround available. Updating Pidgin to the latest version is the recommended solution.
Related vulnerabilities
Recent vulnerabilities recorded for pidgin.
