CVE-2011-2943: Null Pointer Dereference
A NULL pointer dereference flaw was found in the way IRC protocol plug-in of the Pidgin multiprotocol instant messaging client processed certain nick names, when list set of users (/who command) was issued upon user session startup and connecting user has had certain encoding configuration setup. A remote attacker could use a specially-crafted string as their nickname to cause the Pidgin client on the side of the victim (connecting user) to crash.
Upstream bug report: [1] http://developer.pidgin.im/ticket/14341
Acknowledgements:
Red Hat would like to thank the Pidgin project for reporting this issue.
Other sources
The ircmsgwho function in msgs.c in the IRC protocol plugin in libpurple 2.8.0 through 2.9.0 in Pidgin before 2.10.0 does not properly validate characters in nicknames, which allows user-assisted remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted nickname that is not properly handled in a WHO response.
— MITRE
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2011-2943?
CVE-2011-2943 is classified as a moderate severity vulnerability due to the potential for denial of service via NULL pointer dereference.
How do I fix CVE-2011-2943?
To fix CVE-2011-2943, upgrade your Pidgin client to versions 2.8.0 or later, which have addressed the vulnerability.
Which versions of Pidgin are affected by CVE-2011-2943?
CVE-2011-2943 affects all Pidgin versions up to and including 2.9.0.
What type of vulnerability is CVE-2011-2943?
CVE-2011-2943 is a NULL pointer dereference vulnerability specifically found in the IRC protocol plugin of Pidgin.
When was CVE-2011-2943 disclosed?
CVE-2011-2943 was disclosed on August 22, 2011.