The Mxit protocol uses weak encryption when encrypting user passwords, which might allow attackers to (1) decrypt hashed passwords by leveraging knowledge of client registration codes or (2) gain login access by eavesdropping on login messages and re-using the hashed passwords.

A NULL pointer dereference flaw was found in the Pidgin MSN DirectConnect protocol implementation, by processing certain P2P messages. A remote, authenticated user could use this flaw to cause denial of service (Pidgin crash).

Acknowledgements:

Red Hat would like to thank the Pidgin project for reporting this issue. Upstream acknowledges Stu Tomlinson as the original reporter.