cipher.c in the Cipher API in libpurple in Pidgin before 2.7.10 retains encryption-key data in process memory, which might allow local users to obtain sensitive information by reading a core file or other representation of memory contents.
The Yahoo! protocol plugin in libpurple in Pidgin before 2.10.8 does not properly validate UTF-8 data, which allows remote attackers to cause a denial of service (application crash) via crafted byte sequences.
sametime.c in the Sametime protocol plugin in libpurple in Pidgin before 2.10.7 does not properly terminate long user IDs, which allows remote servers to cause a denial of service (application crash) via a crafted packet.
The MXit protocol plugin in libpurple in Pidgin before 2.10.7 might allow remote attackers to create or overwrite files via a crafted (1) mxit or (2) mxit/imagestrips pathname.
upnp.c in libpurple in Pidgin before 2.10.7 does not properly terminate long strings in UPnP responses, which allows remote attackers to cause a denial of service (application crash) by leveraging access to the local network.
Buffer overflow in http.c in the MXit protocol plugin in libpurple in Pidgin before 2.10.7 allows remote servers to execute arbitrary code via a long HTTP header.
It flaw was reported in the way Groupwise server messages were parsed. A malicious server or man-in-the-middle attacker could send a specially-crafted message that could cause Pidgin to attempt to allocate an excessive amount of memory, possibly leading to a crash.
Acknowledgements:
Name: the Pidgin project Upstream: Yves Younan (Cisco Talos), Richard Johnson (Cisco Talos)
A flaw was found in the MXit protocol plug-in. A malicious server or man-in-the-middle attacker could trigger this issue and cause Pidgin to crash by sending a specially-crafted emoticon.
Acknowledgements:
Name: the Pidgin project Upstream: Yves Younan (Cisco Talos), Richard Johnson (Cisco Talos)
Absolute path traversal vulnerability in the untarblock function in win32/untar.c in Pidgin before 2.10.10 on Windows allows remote attackers to write to arbitrary files via a drive name in a tar archive of a smiley theme.
A flaw was found in the way XMPP messages were parsed. A malicious server or possibly a remote attacker could send a crafted XMPP message that would cause Pidgin to send an XMPP message containing arbitrary memory.
Acknowledgements:
Name: the Pidgin project Upstream: Thijs Alkemade, Paul Aurich
It was reported that the SSL/TLS plug-ins failed to check that the Basic Constraints extension allowed intermediate certificates to act as Certificate Authorities (CAs). An attacker could use this flaw to create a fake certificate that Pidgin would trust, which could be used for man-in-the-middle attacks.
This is the same situation as described in http://www.thoughtcrime.org/ie-ssl-chain.txt
Acknowledgments:
Name: the Pidgin project Upstream: Jacob Appelbaum, Moxie Marlinspike