CVE-2017-2640: Critical severity pidgin vulnerability
An out-of-bounds write flaw was found in the way Pidgin before 2.12.0 processed XML content. A malicious remote server could potentially use this flaw to crash Pidgin or execute arbitrary code in the context of the pidgin process.
Other sources
An out-of-bounds write vulnerability was found in purplemarkupunescapeentity. It can be triggered by sending invalid XML entities separated by whitespace, eg "ஸ". In default installation, this can get called only when receiving data from a server.
Upstream patch(es):
https://bitbucket.org/pidgin/main/commits/6745ecd124da91d6711ebab8812247bcd785939a https://bitbucket.org/pidgin/main/commits/b2fc9e774cb9bf6bffcafa156c14a4c7b3640837
— Red Hat
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2017-2640?
CVE-2017-2640 has a high severity rating due to its potential to allow remote code execution or crash the application.
How do I fix CVE-2017-2640?
To fix CVE-2017-2640, upgrade Pidgin to versions 2.13.0, 2.14.1, or 2.14.12 or later.
Which versions of Pidgin are affected by CVE-2017-2640?
Pidgin versions prior to 2.12.0 are affected by CVE-2017-2640.
What risks are associated with CVE-2017-2640?
CVE-2017-2640 presents risks such as crashing the Pidgin application and executing arbitrary code on a vulnerable system.
Is CVE-2017-2640 specific to any operating systems?
CVE-2017-2640 affects Pidgin on multiple operating systems including Debian and Red Hat platforms.