CVE-2011-4603: Input Validation
The silcchannelmessage function in ops.c in the SILC protocol plugin in libpurple in Pidgin before 2.10.1 does not perform the expected UTF-8 validation on message data, which allows remote attackers to cause a denial of service (application crash) via a crafted message, a different vulnerability than CVE-2011-3594.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2011-4603?
CVE-2011-4603 is categorized as a denial of service vulnerability due to application crashes caused by malformed messages.
How do I fix CVE-2011-4603?
To fix CVE-2011-4603, you should update Pidgin to version 2.10.1 or later as it contains the security patch.
What happens if I am still using an affected version of Pidgin related to CVE-2011-4603?
If you are using an affected version of Pidgin, your application may be vulnerable to crashes when receiving crafted messages.
Which versions of Pidgin are affected by CVE-2011-4603?
CVE-2011-4603 affects all Pidgin versions prior to 2.10.1, including versions from 2.0.0 to 2.10.0.
Is it safe to use Pidgin after the fix for CVE-2011-4603 is applied?
Yes, after applying the fix by updating to Pidgin version 2.10.1 or later, the vulnerability CVE-2011-4603 should no longer pose a risk.