CVE-2014-3695: Buffer Overflow
A flaw was found in the MXit protocol plug-in. A malicious server or man-in-the-middle attacker could trigger this issue and cause Pidgin to crash by sending a specially-crafted emoticon.
Acknowledgements:
Name: the Pidgin project Upstream: Yves Younan (Cisco Talos), Richard Johnson (Cisco Talos)
Other sources
markup.c in the MXit protocol plugin in libpurple in Pidgin before 2.10.10 allows remote servers to cause a denial of service (application crash) via a large length value in an emoticon response.
— MITRE
Affected Software
Remediation
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2014-3695?
CVE-2014-3695 has been classified as a moderate severity vulnerability due to its ability to crash the Pidgin application.
How do I fix CVE-2014-3695?
To fix CVE-2014-3695, upgrade to Pidgin version 2.10.10 or later.
Which versions of Pidgin are affected by CVE-2014-3695?
CVE-2014-3695 affects Pidgin versions up to and including 2.10.9.
What type of attack does CVE-2014-3695 enable?
CVE-2014-3695 allows a malicious server or man-in-the-middle attacker to crash Pidgin by sending a specially-crafted emoticon.
Is there a workaround for CVE-2014-3695?
There is no documented workaround for CVE-2014-3695; users are advised to upgrade Pidgin to mitigate the vulnerability.