ID CVE-2017-2640
Summary An out-of-bounds write flaw was found in the way Pidgin before 2.12.0 processed XML content. A malicious remote server could potentially use this flaw to crash Pidgin or execute arbitrary code in the context of the pidgin process.
References
Vulnerable Configurations
  • cpe:2.3:a:pidgin:pidgin:-:*:*:*:*:*:*:*
    cpe:2.3:a:pidgin:pidgin:-:*:*:*:*:*:*:*
  • cpe:2.3:a:pidgin:pidgin:1.5.1:*:*:*:*:*:*:*
    cpe:2.3:a:pidgin:pidgin:1.5.1:*:*:*:*:*:*:*
  • cpe:2.3:a:pidgin:pidgin:2.0.0:*:*:*:*:*:*:*
    cpe:2.3:a:pidgin:pidgin:2.0.0:*:*:*:*:*:*:*
  • cpe:2.3:a:pidgin:pidgin:2.0.1:*:*:*:*:*:*:*
    cpe:2.3:a:pidgin:pidgin:2.0.1:*:*:*:*:*:*:*
  • cpe:2.3:a:pidgin:pidgin:2.0.2:*:*:*:*:*:*:*
    cpe:2.3:a:pidgin:pidgin:2.0.2:*:*:*:*:*:*:*
  • cpe:2.3:a:pidgin:pidgin:2.1.0:*:*:*:*:*:*:*
    cpe:2.3:a:pidgin:pidgin:2.1.0:*:*:*:*:*:*:*
  • cpe:2.3:a:pidgin:pidgin:2.1.1:*:*:*:*:*:*:*
    cpe:2.3:a:pidgin:pidgin:2.1.1:*:*:*:*:*:*:*
  • cpe:2.3:a:pidgin:pidgin:2.2.0:*:*:*:*:*:*:*
    cpe:2.3:a:pidgin:pidgin:2.2.0:*:*:*:*:*:*:*
  • cpe:2.3:a:pidgin:pidgin:2.2.1:*:*:*:*:*:*:*
    cpe:2.3:a:pidgin:pidgin:2.2.1:*:*:*:*:*:*:*
  • cpe:2.3:a:pidgin:pidgin:2.2.2:*:*:*:*:*:*:*
    cpe:2.3:a:pidgin:pidgin:2.2.2:*:*:*:*:*:*:*
  • cpe:2.3:a:pidgin:pidgin:2.3.0:*:*:*:*:*:*:*
    cpe:2.3:a:pidgin:pidgin:2.3.0:*:*:*:*:*:*:*
  • cpe:2.3:a:pidgin:pidgin:2.3.1:*:*:*:*:*:*:*
    cpe:2.3:a:pidgin:pidgin:2.3.1:*:*:*:*:*:*:*
  • cpe:2.3:a:pidgin:pidgin:2.4.0:*:*:*:*:*:*:*
    cpe:2.3:a:pidgin:pidgin:2.4.0:*:*:*:*:*:*:*
  • cpe:2.3:a:pidgin:pidgin:2.4.1:*:*:*:*:*:*:*
    cpe:2.3:a:pidgin:pidgin:2.4.1:*:*:*:*:*:*:*
  • cpe:2.3:a:pidgin:pidgin:2.4.2:*:*:*:*:*:*:*
    cpe:2.3:a:pidgin:pidgin:2.4.2:*:*:*:*:*:*:*
  • cpe:2.3:a:pidgin:pidgin:2.4.3:*:*:*:*:*:*:*
    cpe:2.3:a:pidgin:pidgin:2.4.3:*:*:*:*:*:*:*
  • cpe:2.3:a:pidgin:pidgin:2.5.0:*:*:*:*:*:*:*
    cpe:2.3:a:pidgin:pidgin:2.5.0:*:*:*:*:*:*:*
  • cpe:2.3:a:pidgin:pidgin:2.5.1:*:*:*:*:*:*:*
    cpe:2.3:a:pidgin:pidgin:2.5.1:*:*:*:*:*:*:*
  • cpe:2.3:a:pidgin:pidgin:2.5.2:*:*:*:*:*:*:*
    cpe:2.3:a:pidgin:pidgin:2.5.2:*:*:*:*:*:*:*
  • cpe:2.3:a:pidgin:pidgin:2.5.3:*:*:*:*:*:*:*
    cpe:2.3:a:pidgin:pidgin:2.5.3:*:*:*:*:*:*:*
  • cpe:2.3:a:pidgin:pidgin:2.5.4:*:*:*:*:*:*:*
    cpe:2.3:a:pidgin:pidgin:2.5.4:*:*:*:*:*:*:*
  • cpe:2.3:a:pidgin:pidgin:2.5.5:*:*:*:*:*:*:*
    cpe:2.3:a:pidgin:pidgin:2.5.5:*:*:*:*:*:*:*
  • cpe:2.3:a:pidgin:pidgin:2.5.6:*:*:*:*:*:*:*
    cpe:2.3:a:pidgin:pidgin:2.5.6:*:*:*:*:*:*:*
  • cpe:2.3:a:pidgin:pidgin:2.5.7:*:*:*:*:*:*:*
    cpe:2.3:a:pidgin:pidgin:2.5.7:*:*:*:*:*:*:*
  • cpe:2.3:a:pidgin:pidgin:2.5.8:*:*:*:*:*:*:*
    cpe:2.3:a:pidgin:pidgin:2.5.8:*:*:*:*:*:*:*
  • cpe:2.3:a:pidgin:pidgin:2.5.9:*:*:*:*:*:*:*
    cpe:2.3:a:pidgin:pidgin:2.5.9:*:*:*:*:*:*:*
  • cpe:2.3:a:pidgin:pidgin:2.6.0:*:*:*:*:*:*:*
    cpe:2.3:a:pidgin:pidgin:2.6.0:*:*:*:*:*:*:*
  • cpe:2.3:a:pidgin:pidgin:2.6.1:*:*:*:*:*:*:*
    cpe:2.3:a:pidgin:pidgin:2.6.1:*:*:*:*:*:*:*
  • cpe:2.3:a:pidgin:pidgin:2.6.2:*:*:*:*:*:*:*
    cpe:2.3:a:pidgin:pidgin:2.6.2:*:*:*:*:*:*:*
  • cpe:2.3:a:pidgin:pidgin:2.6.3:*:*:*:*:*:*:*
    cpe:2.3:a:pidgin:pidgin:2.6.3:*:*:*:*:*:*:*
  • cpe:2.3:a:pidgin:pidgin:2.6.4:*:*:*:*:*:*:*
    cpe:2.3:a:pidgin:pidgin:2.6.4:*:*:*:*:*:*:*
  • cpe:2.3:a:pidgin:pidgin:2.6.5:*:*:*:*:*:*:*
    cpe:2.3:a:pidgin:pidgin:2.6.5:*:*:*:*:*:*:*
  • cpe:2.3:a:pidgin:pidgin:2.6.6:*:*:*:*:*:*:*
    cpe:2.3:a:pidgin:pidgin:2.6.6:*:*:*:*:*:*:*
  • cpe:2.3:a:pidgin:pidgin:2.7.0:*:*:*:*:*:*:*
    cpe:2.3:a:pidgin:pidgin:2.7.0:*:*:*:*:*:*:*
  • cpe:2.3:a:pidgin:pidgin:2.7.1:*:*:*:*:*:*:*
    cpe:2.3:a:pidgin:pidgin:2.7.1:*:*:*:*:*:*:*
  • cpe:2.3:a:pidgin:pidgin:2.7.2:*:*:*:*:*:*:*
    cpe:2.3:a:pidgin:pidgin:2.7.2:*:*:*:*:*:*:*
  • cpe:2.3:a:pidgin:pidgin:2.7.3:*:*:*:*:*:*:*
    cpe:2.3:a:pidgin:pidgin:2.7.3:*:*:*:*:*:*:*
  • cpe:2.3:a:pidgin:pidgin:2.7.4:*:*:*:*:*:*:*
    cpe:2.3:a:pidgin:pidgin:2.7.4:*:*:*:*:*:*:*
  • cpe:2.3:a:pidgin:pidgin:2.7.5:*:*:*:*:*:*:*
    cpe:2.3:a:pidgin:pidgin:2.7.5:*:*:*:*:*:*:*
  • cpe:2.3:a:pidgin:pidgin:2.7.6:*:*:*:*:*:*:*
    cpe:2.3:a:pidgin:pidgin:2.7.6:*:*:*:*:*:*:*
  • cpe:2.3:a:pidgin:pidgin:2.7.7:*:*:*:*:*:*:*
    cpe:2.3:a:pidgin:pidgin:2.7.7:*:*:*:*:*:*:*
  • cpe:2.3:a:pidgin:pidgin:2.7.8:*:*:*:*:*:*:*
    cpe:2.3:a:pidgin:pidgin:2.7.8:*:*:*:*:*:*:*
  • cpe:2.3:a:pidgin:pidgin:2.7.9:*:*:*:*:*:*:*
    cpe:2.3:a:pidgin:pidgin:2.7.9:*:*:*:*:*:*:*
  • cpe:2.3:a:pidgin:pidgin:2.7.10:*:*:*:*:*:*:*
    cpe:2.3:a:pidgin:pidgin:2.7.10:*:*:*:*:*:*:*
  • cpe:2.3:a:pidgin:pidgin:2.7.11:*:*:*:*:*:*:*
    cpe:2.3:a:pidgin:pidgin:2.7.11:*:*:*:*:*:*:*
  • cpe:2.3:a:pidgin:pidgin:2.8.0:*:*:*:*:*:*:*
    cpe:2.3:a:pidgin:pidgin:2.8.0:*:*:*:*:*:*:*
  • cpe:2.3:a:pidgin:pidgin:2.9.0:*:*:*:*:*:*:*
    cpe:2.3:a:pidgin:pidgin:2.9.0:*:*:*:*:*:*:*
  • cpe:2.3:a:pidgin:pidgin:2.10.0:*:*:*:*:*:*:*
    cpe:2.3:a:pidgin:pidgin:2.10.0:*:*:*:*:*:*:*
  • cpe:2.3:a:pidgin:pidgin:2.10.1:*:*:*:*:*:*:*
    cpe:2.3:a:pidgin:pidgin:2.10.1:*:*:*:*:*:*:*
  • cpe:2.3:a:pidgin:pidgin:2.10.2:*:*:*:*:*:*:*
    cpe:2.3:a:pidgin:pidgin:2.10.2:*:*:*:*:*:*:*
  • cpe:2.3:a:pidgin:pidgin:2.10.3:*:*:*:*:*:*:*
    cpe:2.3:a:pidgin:pidgin:2.10.3:*:*:*:*:*:*:*
  • cpe:2.3:a:pidgin:pidgin:2.10.4:*:*:*:*:*:*:*
    cpe:2.3:a:pidgin:pidgin:2.10.4:*:*:*:*:*:*:*
  • cpe:2.3:a:pidgin:pidgin:2.10.5:*:*:*:*:*:*:*
    cpe:2.3:a:pidgin:pidgin:2.10.5:*:*:*:*:*:*:*
  • cpe:2.3:a:pidgin:pidgin:2.10.6:*:*:*:*:*:*:*
    cpe:2.3:a:pidgin:pidgin:2.10.6:*:*:*:*:*:*:*
  • cpe:2.3:a:pidgin:pidgin:2.10.7:*:*:*:*:*:*:*
    cpe:2.3:a:pidgin:pidgin:2.10.7:*:*:*:*:*:*:*
  • cpe:2.3:a:pidgin:pidgin:2.10.8:*:*:*:*:*:*:*
    cpe:2.3:a:pidgin:pidgin:2.10.8:*:*:*:*:*:*:*
  • cpe:2.3:a:pidgin:pidgin:2.10.9:*:*:*:*:*:*:*
    cpe:2.3:a:pidgin:pidgin:2.10.9:*:*:*:*:*:*:*
  • cpe:2.3:a:pidgin:pidgin:2.10.10:*:*:*:*:*:*:*
    cpe:2.3:a:pidgin:pidgin:2.10.10:*:*:*:*:*:*:*
  • cpe:2.3:a:pidgin:pidgin:2.10.11:*:*:*:*:*:*:*
    cpe:2.3:a:pidgin:pidgin:2.10.11:*:*:*:*:*:*:*
  • cpe:2.3:a:pidgin:pidgin:2.10.12:*:*:*:*:*:*:*
    cpe:2.3:a:pidgin:pidgin:2.10.12:*:*:*:*:*:*:*
  • cpe:2.3:a:pidgin:pidgin:2.11.0:*:*:*:*:*:*:*
    cpe:2.3:a:pidgin:pidgin:2.11.0:*:*:*:*:*:*:*
  • cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*
    cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*
  • cpe:2.3:o:redhat:enterprise_linux_desktop:7.0:*:*:*:*:*:*:*
    cpe:2.3:o:redhat:enterprise_linux_desktop:7.0:*:*:*:*:*:*:*
  • cpe:2.3:o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:*
    cpe:2.3:o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:*
  • cpe:2.3:o:redhat:enterprise_linux_server_aus:7.4:*:*:*:*:*:*:*
    cpe:2.3:o:redhat:enterprise_linux_server_aus:7.4:*:*:*:*:*:*:*
  • cpe:2.3:o:redhat:enterprise_linux_server_eus:7.4:*:*:*:*:*:*:*
    cpe:2.3:o:redhat:enterprise_linux_server_eus:7.4:*:*:*:*:*:*:*
  • cpe:2.3:o:redhat:enterprise_linux_server_eus:7.5:*:*:*:*:*:*:*
    cpe:2.3:o:redhat:enterprise_linux_server_eus:7.5:*:*:*:*:*:*:*
  • cpe:2.3:o:redhat:enterprise_linux_workstation:7.0:*:*:*:*:*:*:*
    cpe:2.3:o:redhat:enterprise_linux_workstation:7.0:*:*:*:*:*:*:*
CVSS
Base: 7.5 (as of 09-10-2019 - 23:27)
Impact:
Exploitability:
CWE CWE-787
CAPEC
Access
VectorComplexityAuthentication
NETWORK LOW NONE
Impact
ConfidentialityIntegrityAvailability
PARTIAL PARTIAL PARTIAL
cvss-vector via4 AV:N/AC:L/Au:N/C:P/I:P/A:P
redhat via4
advisories
bugzilla
id 1446368
title Silence -Wsign-compare
oval
OR
  • comment Red Hat Enterprise Linux must be installed
    oval oval:com.redhat.rhba:tst:20070304026
  • AND
    • comment Red Hat Enterprise Linux 7 is installed
      oval oval:com.redhat.rhba:tst:20150364027
    • OR
      • AND
        • comment finch is earlier than 0:2.10.11-5.el7
          oval oval:com.redhat.rhsa:tst:20171854001
        • comment finch is signed with Red Hat redhatrelease2 key
          oval oval:com.redhat.rhba:tst:20192044032
      • AND
        • comment finch-devel is earlier than 0:2.10.11-5.el7
          oval oval:com.redhat.rhsa:tst:20171854003
        • comment finch-devel is signed with Red Hat redhatrelease2 key
          oval oval:com.redhat.rhba:tst:20192044034
      • AND
        • comment libpurple is earlier than 0:2.10.11-5.el7
          oval oval:com.redhat.rhsa:tst:20171854005
        • comment libpurple is signed with Red Hat redhatrelease2 key
          oval oval:com.redhat.rhba:tst:20192044036
      • AND
        • comment libpurple-devel is earlier than 0:2.10.11-5.el7
          oval oval:com.redhat.rhsa:tst:20171854007
        • comment libpurple-devel is signed with Red Hat redhatrelease2 key
          oval oval:com.redhat.rhba:tst:20192044038
      • AND
        • comment libpurple-perl is earlier than 0:2.10.11-5.el7
          oval oval:com.redhat.rhsa:tst:20171854009
        • comment libpurple-perl is signed with Red Hat redhatrelease2 key
          oval oval:com.redhat.rhba:tst:20192044040
      • AND
        • comment libpurple-tcl is earlier than 0:2.10.11-5.el7
          oval oval:com.redhat.rhsa:tst:20171854011
        • comment libpurple-tcl is signed with Red Hat redhatrelease2 key
          oval oval:com.redhat.rhba:tst:20192044042
      • AND
        • comment pidgin is earlier than 0:2.10.11-5.el7
          oval oval:com.redhat.rhsa:tst:20171854013
        • comment pidgin is signed with Red Hat redhatrelease2 key
          oval oval:com.redhat.rhba:tst:20192044044
      • AND
        • comment pidgin-devel is earlier than 0:2.10.11-5.el7
          oval oval:com.redhat.rhsa:tst:20171854015
        • comment pidgin-devel is signed with Red Hat redhatrelease2 key
          oval oval:com.redhat.rhba:tst:20192044046
      • AND
        • comment pidgin-perl is earlier than 0:2.10.11-5.el7
          oval oval:com.redhat.rhsa:tst:20171854017
        • comment pidgin-perl is signed with Red Hat redhatrelease2 key
          oval oval:com.redhat.rhba:tst:20192044048
rhsa
id RHSA-2017:1854
released 2017-08-01
severity Moderate
title RHSA-2017:1854: pidgin security, bug fix, and enhancement update (Moderate)
rpms
  • finch-0:2.10.11-5.el7
  • finch-devel-0:2.10.11-5.el7
  • libpurple-0:2.10.11-5.el7
  • libpurple-devel-0:2.10.11-5.el7
  • libpurple-perl-0:2.10.11-5.el7
  • libpurple-tcl-0:2.10.11-5.el7
  • pidgin-0:2.10.11-5.el7
  • pidgin-debuginfo-0:2.10.11-5.el7
  • pidgin-devel-0:2.10.11-5.el7
  • pidgin-perl-0:2.10.11-5.el7
refmap via4
bid 96775
confirm https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-2640
debian DSA-3806
gentoo GLSA-201706-10
Last major update 09-10-2019 - 23:27
Published 27-07-2018 - 18:29
Last modified 09-10-2019 - 23:27
Back to Top