Information disclosure in Pidgin

CVE-2014-3698

The jabber_idn_validate function in jutil.c in the Jabber protocol plugin in libpurple in Pidgin before 2.10.10 allows remote attackers to obtain sensitive information from process memory via a crafted XMPP message.

Vulnerability class: Information Disclosure

EPSS: 0.038 (88.8th percentile) — read the EPSS interpretation.

Affected products

  • Pidgin — versions 2.10.0, 2.10.1, 2.10.2
  • N/a — versions n/a

Weakness classification (CWE)

References