{"schemaVersion":3,"id":"MGASA-2014-0034","aliases":[],"status":"published","duplicateOf":null,"title":null,"description":"Updated pidgin package fixes security vulnerabilities\n\nMany places in the Yahoo! protocol plugin assumed incoming strings were\nUTF-8 and failed to transcode from non-UTF-8 encodings. This can lead to a\ncrash  when receiving strings that aren't UTF-8 (CVE-2012-6152).\n\nA remote XMPP user can trigger a crash on some systems by sending a\nmessage with a timestamp in the distant future (CVE-2013-6477).\n\nlibX11 forcefully exits causing a crash when Pidgin tries to create an\nexceptionally wide tooltip window when hovering the pointer over a long\nURL (CVE-2013-6478).\n\nA malicious server or man-in-the-middle could send a malformed HTTP\nresponse that could lead to a crash (CVE-2013-6479).\n\nThe Yahoo! protocol plugin failed to validate a length field before trying\nto read from a buffer, which could result in reading past the end of the\nbuffer which could cause a crash when reading a P2P message\n(CVE-2013-6481).\n\nNULL pointer dereferences in the MSN protocol plugin due to a malformed\nContent-Length header, or a malicious server or man-in-the-middle sending\na specially crafted OIM data XML response or SOAP response\n(CVE-2013-6482).\n\nThe XMPP protocol plugin failed to ensure that iq replies came from the\nperson they were sent to. A remote user could send a spoofed iq reply and\nattempt to guess the iq id. This could allow an attacker to inject fake\ndata or trigger a null pointer dereference (CVE-2013-6483).\n\nIncorrect error handling when reading the response from a STUN server\ncould lead to a crash (CVE-2013-6484).\n\nA malicious server or man-in-the-middle could cause a buffer overflow by\nsending a malformed HTTP response with chunked Transfer-Encoding with\ninvalid chunk sizes (CVE-2013-6485).\n\nA malicious server or man-in-the-middle could send a large value for\nContent-Length and cause an integer overflow which could lead to a buffer\noverflow in Gadu-Gadu HTTP parsing (CVE-2013-6487).\n\nA specially crafted emoticon value could cause an integer overflow which\ncould lead to a buffer overflow in MXit emoticon parsing (CVE-2013-6489).\n\nA Content-Length of -1 could lead to a buffer overflow in SIMPLE header\nparsing (CVE-2013-6490).\n\nA malicious server or man-in-the-middle could trigger a crash in IRC\nargument parsing in libpurple by sending a message with fewer than\nexpected arguments\n(CVE-2014-0020).","dates":{"published":"2014-02-05T15:31:44.000Z","modified":"2026-04-16T06:23:42.117Z","reserved":null,"kevAdded":[],"kevDue":[]},"cvss":{"headline":{"score":null,"severity":"unknown","version":null,"versionLabel":null,"source":null,"vector":null,"computed":false,"selection":"none"},"metrics":[]},"epss":{"probability":null,"percentile":null,"severity":"unknown","asOf":null,"change":{"pp":null,"baselineDate":null,"baselineScore":null},"history":[],"last30":[]},"kev":{"state":"not-listed","entries":[],"listedCount":0,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":false,"entry":null},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[],"exploitCount":0,"weaknesses":[],"affected":[{"vendor":"mageia","product":"pidgin","name":"pidgin","label":"pidgin","ecosystem":"Mageia","cpePart":null,"purl":"pkg:rpm/mageia/pidgin","purlType":"rpm","versions":[{"text":"< 2.10.9-1.mga3","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.10.9-1.mga3","eol":null,"hubHref":null}],"affectedCount":1,"eol":{"hasEol":false,"count":0},"references":[{"url":"https://advisories.mageia.org/MGASA-2014-0034.html","label":"advisories.mageia.org/MGASA-2014-0034.html","hostname":"advisories.mageia.org","tags":["Advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=12468","label":"bugs.mageia.org/show_bug.cgi?id=12468","hostname":"bugs.mageia.org","tags":["REPORT"]},{"url":"http://pidgin.im/news/security/?id=70","label":"pidgin.im/news/security/?id=70","hostname":"pidgin.im","tags":["WEB"]},{"url":"http://pidgin.im/news/security/?id=71","label":"pidgin.im/news/security/?id=71","hostname":"pidgin.im","tags":["WEB"]},{"url":"http://pidgin.im/news/security/?id=72","label":"pidgin.im/news/security/?id=72","hostname":"pidgin.im","tags":["WEB"]},{"url":"http://pidgin.im/news/security/?id=73","label":"pidgin.im/news/security/?id=73","hostname":"pidgin.im","tags":["WEB"]},{"url":"http://pidgin.im/news/security/?id=74","label":"pidgin.im/news/security/?id=74","hostname":"pidgin.im","tags":["WEB"]},{"url":"http://pidgin.im/news/security/?id=75","label":"pidgin.im/news/security/?id=75","hostname":"pidgin.im","tags":["WEB"]},{"url":"http://pidgin.im/news/security/?id=76","label":"pidgin.im/news/security/?id=76","hostname":"pidgin.im","tags":["WEB"]},{"url":"http://pidgin.im/news/security/?id=77","label":"pidgin.im/news/security/?id=77","hostname":"pidgin.im","tags":["WEB"]},{"url":"http://pidgin.im/news/security/?id=78","label":"pidgin.im/news/security/?id=78","hostname":"pidgin.im","tags":["WEB"]},{"url":"http://pidgin.im/news/security/?id=79","label":"pidgin.im/news/security/?id=79","hostname":"pidgin.im","tags":["WEB"]},{"url":"http://pidgin.im/news/security/?id=80","label":"pidgin.im/news/security/?id=80","hostname":"pidgin.im","tags":["WEB"]},{"url":"http://pidgin.im/news/security/?id=82","label":"pidgin.im/news/security/?id=82","hostname":"pidgin.im","tags":["WEB"]},{"url":"http://pidgin.im/news/security/?id=83","label":"pidgin.im/news/security/?id=83","hostname":"pidgin.im","tags":["WEB"]},{"url":"http://pidgin.im/news/security/?id=84","label":"pidgin.im/news/security/?id=84","hostname":"pidgin.im","tags":["WEB"]},{"url":"http://pidgin.im/news/security/?id=85","label":"pidgin.im/news/security/?id=85","hostname":"pidgin.im","tags":["WEB"]},{"url":"https://developer.pidgin.im/wiki/ChangeLog","label":"developer.pidgin.im/wiki/ChangeLog","hostname":"developer.pidgin.im","tags":["WEB"]}],"lineage":{"upstream":["CVE-2012-6152","CVE-2013-6477","CVE-2013-6478","CVE-2013-6479","CVE-2013-6481","CVE-2013-6482","CVE-2013-6483","CVE-2013-6484","CVE-2013-6485","CVE-2013-6487","CVE-2013-6489","CVE-2013-6490","CVE-2014-0020"],"downstream":[],"duplicates":[],"related":[]},"timeline":[{"kind":"published","date":"2014-02-05T15:31:44.000Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"modified","date":"2026-04-16T06:23:42.117Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":0,"level":"minimal","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-20T19:19:24.761Z","stale":false,"partial":false}}