CVE-2014-3698: Infoleak
A flaw was found in the way XMPP messages were parsed. A malicious server or possibly a remote attacker could send a crafted XMPP message that would cause Pidgin to send an XMPP message containing arbitrary memory.
Acknowledgements:
Name: the Pidgin project Upstream: Thijs Alkemade, Paul Aurich
Other sources
The jabberidnvalidate function in jutil.c in the Jabber protocol plugin in libpurple in Pidgin before 2.10.10 allows remote attackers to obtain sensitive information from process memory via a crafted XMPP message.
— MITRE
Affected Software
Remediation
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2014-3698?
CVE-2014-3698 has a moderate severity, as it can lead to the disclosure of sensitive information such as arbitrary memory.
How do I fix CVE-2014-3698?
To fix CVE-2014-3698, upgrade Pidgin to version 2.10.10 or later.
Which versions of Pidgin are affected by CVE-2014-3698?
CVE-2014-3698 affects Pidgin versions up to 2.10.9, including versions 2.10.0 to 2.10.9.
Can CVE-2014-3698 be exploited remotely?
Yes, CVE-2014-3698 can be exploited by a malicious server or remote attacker.
What components of Pidgin are specifically vulnerable in CVE-2014-3698?
The vulnerability in CVE-2014-3698 specifically affects the parsing of XMPP messages in Pidgin.