CVE-2014-3694: canonical ubuntu_linux Cryptographic Issues
Vulnerability summary
CVE-2014-3694 is a medium (CVSS 6.4) Cryptographic Issues vulnerability in canonical ubuntu_linux. EPSS estimates a 2.35% chance of exploitation in the next 30 days, higher than 83.4% of scored vulnerabilities.
Advisory lineage
Upstream 0 · Downstream 4 · Related 1Timeline
- 29-10-2014PublishedVulnerability first disclosed.
- 06-08-2024Last modifiedVulnerability information updated.
Description
The (1) bundled GnuTLS SSL/TLS plugin and the (2) bundled OpenSSL SSL/TLS plugin in libpurple in Pidgin before 2.10.10 do not properly consider the Basic Constraints extension during verification of X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVSS metrics
1 score · 1 source · 1 versionEPSS trend
Probability
2.35%
Chance of exploitation in the next 30 days
Percentile
83%
Versus all other CVEs
30-day change
0.00 pp
From 2.35% on 20-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Debian2 products
- pidgin< 2.10.10-1
- debian_linuxEOL7.0
Canonical1 product
- ubuntu_linuxEOL12.04 | 14.04 | 14.10
Opensuse1 product
- opensuseEOL12.3 | 13.1 | 13.2
Pidgin1 product
- pidgin≤ 2.10.9 | 2.10.0 | 2.10.1 | 2.10.2 | 2.10.3 | 2.10.4 | 2.10.5 | 2.10.6 | 2.10.7 | 2.10.8
Ubuntu1 product
- pidgin< 1:2.10.9-0ubuntu3.2
5 vendors · 6 products
References
14 links- lists.opensuse.org/opensuse-updates/2014-11/msg00023.htmlVendor AdvisoryX Refsource SUSEThird Party Advisory
- lists.opensuse.org/opensuse-updates/2014-11/msg00037.htmlVendor AdvisoryX Refsource SUSEThird Party Advisory