CVE-2014-3696: Buffer Overflow
It flaw was reported in the way Groupwise server messages were parsed. A malicious server or man-in-the-middle attacker could send a specially-crafted message that could cause Pidgin to attempt to allocate an excessive amount of memory, possibly leading to a crash.
Acknowledgements:
Name: the Pidgin project Upstream: Yves Younan (Cisco Talos), Richard Johnson (Cisco Talos)
Other sources
nmevent.c in the Novell GroupWise protocol plugin in libpurple in Pidgin before 2.10.10 allows remote servers to cause a denial of service (application crash) via a crafted server message that triggers a large memory allocation.
— MITRE
Affected Software
Remediation
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2014-3696?
CVE-2014-3696 is considered a medium severity vulnerability due to its potential to crash the Pidgin application.
How do I fix CVE-2014-3696?
To fix CVE-2014-3696, upgrade Pidgin to version 2.10.10 or later.
Which versions of Pidgin are affected by CVE-2014-3696?
CVE-2014-3696 affects Pidgin versions up to 2.10.9.
What type of attack does CVE-2014-3696 facilitate?
CVE-2014-3696 could be exploited by a malicious server or a man-in-the-middle attacker.
What can happen if I do not address CVE-2014-3696?
If not addressed, CVE-2014-3696 can cause Pidgin to allocate excessive memory and potentially crash.