Denial of Service Vulnerability in Pidgin XMPP Protocol Plugin
Summary
DEBIAN-CVE-2011-4602: The XMPP protocol plugin in libpurple in Pidgin before 2.10.1 does not properly handle missing fields in (1) voice-chat and (2) video-chat stanzas, which allows remote attackers to cause a denial of service (application... Affects pidgin versions < 2.10.1-1. Fixed in 2.10.1-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Pidgin is an open-source instant messaging client that allows users to connect to multiple chat networks simultaneously. It supports various protocols, including XMPP, which is widely used for real-time communication. The application is known for its extensibility and user-friendly interface. However, a vulnerability in the XMPP protocol plugin can lead to application crashes, impacting user experience and reliability.
Vulnerability Detail
The XMPP protocol plugin in libpurple within Pidgin versions prior to 2.10.1 does not adequately handle missing fields in voice-chat and video-chat stanzas. This oversight allows remote attackers to send crafted messages that can trigger a denial of service, causing the application to crash. The vulnerability is identified as DEBIAN-CVE-2011-4602 and poses a low urgency risk, but it can significantly disrupt communication for users relying on the affected features.
How To Fix
Minimum fixed version
2.10.1-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade pidginTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, users can avoid using voice-chat and video-chat features until the application is updated to the patched version. This will help mitigate the risk of denial of service attacks while waiting for the update.
Conclusion
The vulnerability in the Pidgin XMPP protocol plugin poses a risk of denial of service due to improper handling of message fields. Users are strongly advised to update to version 2.10.1-1 or later to ensure their application is secure. Until then, avoiding certain features can help mitigate risks.
See every vulnerability recorded for pidgin →
FAQ
The vulnerability allows remote attackers to crash the Pidgin application by sending specially crafted messages that exploit missing fields in the XMPP protocol.
You can check your version of Pidgin by opening the application and navigating to 'Help' > 'About'. If your version is below 2.10.1, it is affected.
Yes, you can use Vulert, which monitors and alerts for open-source vulnerabilities in your software using just a manifest file like package-lock.json. You can check your application for vulnerabilities using the Vulert playground without any signup.
If you cannot update immediately, avoid using the voice-chat and video-chat features to minimize the risk of a denial of service attack.
More information can be found in the official Debian CVE database or by visiting the provided source link: https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2011-4602.json.
References
Related vulnerabilities
Recent vulnerabilities recorded for pidgin.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
