Pidgin - vulnerabilities (CVEs)

88 CVEs in 3 products, 0 in the last 30 days, newest from 2026-03-21.

Products

• Pidgin - 87 CVEs
• Libpurple - 7 CVEs
• Mxit - 1 CVEs

Newest CVEs of Pidgin

• CVE-2019-25544 - CVSS 6.9 (medium), 2026-03-21: Pidgin 2.13.0 contains a denial of service vulnerability that allows local attackers to crash the application by providing an excessively long username string…
• CVE-2022-26491 - CVSS 5.9 (medium), 2022-06-02: An issue was discovered in Pidgin before 2.14.9. A remote attacker who can spoof DNS responses can redirect a client connection to a malicious server. The…
• CVE-2012-1257 - CVSS 5.5 (medium), 2019-11-20: Pidgin 2.10.0 uses DBUS for certain cleartext communication, which allows local users to obtain sensitive information via a dbus session monitor.
• CVE-2016-1000030 - CVSS 9.8 (critical), 2018-09-05: Pidgin version <2.11.0 contains a vulnerability in X.509 Certificates imports specifically due to improper check of return values from gnutls_x509_crt_init()…
• CVE-2017-2640 - CVSS 9.8 (critical), 2018-07-27: An out-of-bounds write flaw was found in the way Pidgin before 2.12.0 processed XML content. A malicious remote server could potentially use this flaw to…
• CVE-2016-2379 - CVSS 8.8 (high), 2017-03-29: The Mxit protocol uses weak encryption when encrypting user passwords, which might allow attackers to (1) decrypt hashed passwords by leveraging knowledge of…
• CVE-2016-2377 - CVSS 8.1 (high), 2017-01-06: A buffer overflow vulnerability exists in the handling of the MXIT protocol in Pidgin. Specially crafted MXIT data sent by the server could potentially result…
• CVE-2016-4323 - CVSS 3.7 (low), 2017-01-06: A directory traversal exists in the handling of the MXIT protocol in Pidgin. Specially crafted MXIT data sent from the server could potentially result in an…
• CVE-2016-2380 - CVSS 3.1 (low), 2017-01-06: An information leak exists in the handling of the MXIT protocol in Pidgin. Specially crafted MXIT data sent to the server could potentially result in an…
• CVE-2016-2378 - CVSS 8.1 (high), 2017-01-06: A buffer overflow vulnerability exists in the handling of the MXIT protocol Pidgin. Specially crafted data sent via the server could potentially result in a…
• CVE-2016-2368 - CVSS 8.1 (high), 2017-01-06: Multiple memory corruption vulnerabilities exist in the handling of the MXIT protocol in Pidgin. Specially crafted MXIT data sent via the server could result…
• CVE-2016-2371 - CVSS 8.1 (high), 2017-01-06: An out-of-bounds write vulnerability exists in the handling of the MXIT protocol in Pidgin. Specially crafted MXIT data sent via the server could cause memory…
• CVE-2016-2374 - CVSS 8.1 (high), 2017-01-06: An exploitable memory corruption vulnerability exists in the handling of the MXIT protocol in Pidgin. Specially crafted MXIT MultiMX message sent via the…
• CVE-2016-2367 - CVSS 5.9 (medium), 2017-01-06: An information leak exists in the handling of the MXIT protocol in Pidgin. Specially crafted MXIT data sent via the server could potentially result in an…
• CVE-2016-2370 - CVSS 5.9 (medium), 2017-01-06: A denial of service vulnerability exists in the handling of the MXIT protocol in Pidgin. Specially crafted MXIT data sent from the server could potentially…
• CVE-2016-2373 - CVSS 5.9 (medium), 2017-01-06: A denial of service vulnerability exists in the handling of the MXIT protocol in Pidgin. Specially crafted MXIT data sent via the server could potentially…
• CVE-2016-2376 - CVSS 8.1 (high), 2017-01-06: A buffer overflow vulnerability exists in the handling of the MXIT protocol in Pidgin. Specially crafted MXIT data sent from the server could potentially…
• CVE-2016-2366 - CVSS 5.9 (medium), 2017-01-06: A denial of service vulnerability exists in the handling of the MXIT protocol in Pidgin. Specially crafted MXIT data sent via the server could potentially…
• CVE-2016-2369 - CVSS 5.9 (medium), 2017-01-06: A NULL pointer dereference vulnerability exists in the handling of the MXIT protocol in Pidgin. Specially crafted MXIT data sent via the server could…
• CVE-2016-2372 - CVSS 5.9 (medium), 2017-01-06: An information leak exists in the handling of the MXIT protocol in Pidgin. Specially crafted MXIT data sent via the server could potentially result in an…
• CVE-2016-2375 - CVSS 5.3 (medium), 2017-01-06: An exploitable out-of-bounds read exists in the handling of the MXIT protocol in Pidgin. Specially crafted MXIT contact information sent from the server can…
• CVE-2016-2365 - CVSS 5.9 (medium), 2017-01-06: A denial of service vulnerability exists in the handling of the MXIT protocol in Pidgin. Specially crafted MXIT data sent via the server could potentially…
• CVE-2014-3696 - CVSS 5 (medium), 2014-10-29: nmevent.c in the Novell GroupWise protocol plugin in libpurple in Pidgin before 2.10.10 allows remote servers to cause a denial of service (application crash)…
• CVE-2014-3695 - CVSS 5 (medium), 2014-10-29: markup.c in the MXit protocol plugin in libpurple in Pidgin before 2.10.10 allows remote servers to cause a denial of service (application crash) via a large…
• CVE-2014-3698 - CVSS 5 (medium), 2014-10-29: The jabber_idn_validate function in jutil.c in the Jabber protocol plugin in libpurple in Pidgin before 2.10.10 allows remote attackers to obtain sensitive…
• CVE-2014-3694 - CVSS 6.4 (medium), 2014-10-29: The (1) bundled GnuTLS SSL/TLS plugin and the (2) bundled OpenSSL SSL/TLS plugin in libpurple in Pidgin before 2.10.10 do not properly consider the Basic…
• CVE-2014-3697 - CVSS 6.4 (medium), 2014-10-29: Absolute path traversal vulnerability in the untar_block function in win32/untar.c in Pidgin before 2.10.10 on Windows allows remote attackers to write to…
• CVE-2013-6490 - CVSS 10 (critical), 2014-02-06: The SIMPLE protocol functionality in Pidgin before 2.10.8 allows remote attackers to have an unspecified impact via a negative Content-Length header, which…
• CVE-2013-6482 - CVSS 5 (medium), 2014-02-06: Pidgin before 2.10.8 allows remote MSN servers to cause a denial of service (NULL pointer dereference and crash) via a crafted (1) SOAP response, (2) OIM XML…
• CVE-2013-6481 - CVSS 5 (medium), 2014-02-06: libpurple/protocols/yahoo/libymsg.c in Pidgin before 2.10.8 allows remote attackers to cause a denial of service (crash) via a Yahoo! P2P message with a…