CVE-2010-0420: Input Validation
libpurple in Finch in Pidgin before 2.6.6, when an XMPP multi-user chat (MUC) room is used, does not properly parse nicknames containing <br> sequences, which allows remote attackers to cause a denial of service (application crash) via a crafted nickname.
Other sources
Pidgin 2.6.6 is fixing a remote crash bug in Finch (text-based client using libpurple). If someone changes nick to '<br>' in XMPP MUC (multi-user chat), it causes Finch to crash.
Acknowledgements:
Red Hat would like to thank Sadrul Habib Chowdhury of the Pidgin project for responsibly reporting this issue.
— Red Hat
Affected Software
Remediation
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2010-0420?
CVE-2010-0420 has a severity rating that indicates it can lead to a denial of service due to application crashes.
How do I fix CVE-2010-0420?
To fix CVE-2010-0420, users should upgrade to Pidgin version 2.6.6 or later.
What software is affected by CVE-2010-0420?
CVE-2010-0420 affects Pidgin versions from 2.0.0 up to and including 2.6.5.
What type of vulnerability is CVE-2010-0420?
CVE-2010-0420 is a denial of service vulnerability caused by improper parsing of nicknames in XMPP multi-user chat rooms.
Can I still use Pidgin if I have CVE-2010-0420?
It is not recommended to use Pidgin versions affected by CVE-2010-0420 as they are vulnerable to potential crashes.