CVE-2010-0420

libpurple in Finch in Pidgin before 2.6.6, when an XMPP multi-user chat (MUC) room is used, does not properly parse nicknames containing <br> sequences, which allows remote attackers to cause a denial of service (application crash) via a crafted nickname.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
4.3 UNKNOWN
NETWORK
MEDIUM
AV:N/AC:M/Au:N/C:N/I:N/A:P
Base Score
CVSS 3.x
EPSS Score
Percentile: 87%
Affected Products (NVD)
VendorProductVersion
pidginpidgin
𝑥
≤ 2.6.5
pidginpidgin
2.0.0
pidginpidgin
2.0.1
pidginpidgin
2.0.2
pidginpidgin
2.1.0
pidginpidgin
2.1.1
pidginpidgin
2.2.0
pidginpidgin
2.2.1
pidginpidgin
2.2.2
pidginpidgin
2.3.0
pidginpidgin
2.3.1
pidginpidgin
2.4.0
pidginpidgin
2.4.1
pidginpidgin
2.4.2
pidginpidgin
2.4.3
pidginpidgin
2.5.0
pidginpidgin
2.5.1
pidginpidgin
2.5.2
pidginpidgin
2.5.3
pidginpidgin
2.5.4
pidginpidgin
2.5.5
pidginpidgin
2.5.6
pidginpidgin
2.5.7
pidginpidgin
2.5.8
pidginpidgin
2.5.9
pidginpidgin
2.6.0
pidginpidgin
2.6.1
pidginpidgin
2.6.2
pidginpidgin
2.6.4
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
pidgin
bookworm
2.14.12-1
fixed
bullseye
2.14.1-1
fixed
lenny
not-affected
sid
2.14.13-2
fixed
trixie
2.14.13-2
fixed
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
pidgin
dapper
dne
hardy
Fixed 1:2.4.1-1ubuntu2.9
released
intrepid
Fixed 1:2.5.2-0ubuntu1.7
released
jaunty
Fixed 1:2.5.5-1ubuntu8.6
released
karmic
Fixed 1:2.6.2-1ubuntu7.2
released
openSUSE logo
openSUSE / SLES Releases
openSUSE Product
Release
finch
suse enterprise desktop 12
2.10.9-5.15
fixed
suse enterprise desktop 12 SP1
2.10.9-8.1
fixed
suse enterprise desktop 12 SP2
2.11.0-12.5
fixed
suse enterprise desktop 12 SP3
2.12.0-1.33
fixed
suse enterprise desktop 12 SP4
2.12.0-3.3.1
fixed
suse enterprise sap 12
2.10.9-5.15
fixed
suse enterprise sap 12 SP1
2.10.9-8.1
fixed
suse enterprise sap 12 SP2
2.11.0-12.5
fixed
suse enterprise sap 12 SP3
2.12.0-1.33
fixed
suse enterprise sap 12 SP4
2.12.0-3.3.1
fixed
suse enterprise sap 12 SP5
2.12.0-3.3.1
fixed
suse enterprise server 12
2.10.9-5.15
fixed
suse enterprise server 12 SP1
2.10.9-8.1
fixed
suse enterprise server 12 SP2
2.11.0-12.5
fixed
suse enterprise server 12 SP3
2.12.0-1.33
fixed
suse enterprise server 12 SP4
2.12.0-3.3.1
fixed
suse enterprise server 12 SP5
2.12.0-3.3.1
fixed
suse enterprise workstation 12
2.10.9-5.15
fixed
suse enterprise workstation 12 SP1
2.10.9-8.1
fixed
suse enterprise workstation 12 SP2
2.11.0-12.5
fixed
suse enterprise workstation 12 SP3
2.12.0-1.33
fixed
suse enterprise workstation 12 SP4
2.12.0-3.3.1
fixed
suse enterprise workstation 12 SP5
2.12.0-3.3.1
fixed
libpurple
suse enterprise desktop 12
2.10.9-5.15
fixed
suse enterprise desktop 12 SP1
2.10.9-8.1
fixed
suse enterprise desktop 12 SP2
2.11.0-12.5
fixed
suse enterprise desktop 12 SP3
2.12.0-1.33
fixed
suse enterprise desktop 12 SP4
2.12.0-3.3.1
fixed
suse enterprise sap 12
2.10.9-5.15
fixed
suse enterprise sap 12 SP1
2.10.9-8.1
fixed
suse enterprise sap 12 SP2
2.11.0-12.5
fixed
suse enterprise sap 12 SP3
2.12.0-1.33
fixed
suse enterprise sap 12 SP4
2.12.0-3.3.1
fixed
suse enterprise sap 12 SP5
2.12.0-3.3.1
fixed
suse enterprise server 12
2.10.9-5.15
fixed
suse enterprise server 12 SP1
2.10.9-8.1
fixed
suse enterprise server 12 SP2
2.11.0-12.5
fixed
suse enterprise server 12 SP3
2.12.0-1.33
fixed
suse enterprise server 12 SP4
2.12.0-3.3.1
fixed
suse enterprise server 12 SP5
2.12.0-3.3.1
fixed
suse enterprise workstation 12
2.10.9-5.15
fixed
suse enterprise workstation 12 SP1
2.10.9-8.1
fixed
suse enterprise workstation 12 SP2
2.11.0-12.5
fixed
suse enterprise workstation 12 SP3
2.12.0-1.33
fixed
suse enterprise workstation 12 SP4
2.12.0-3.3.1
fixed
suse enterprise workstation 12 SP5
2.12.0-3.3.1
fixed
libpurple-branding-upstream
suse enterprise desktop 12 SP3
2.12.0-1.33
fixed
suse enterprise desktop 12 SP4
2.12.0-3.3.1
fixed
suse enterprise sap 12 SP3
2.12.0-1.33
fixed
suse enterprise sap 12 SP4
2.12.0-3.3.1
fixed
suse enterprise sap 12 SP5
2.12.0-3.3.1
fixed
suse enterprise server 12 SP3
2.12.0-1.33
fixed
suse enterprise server 12 SP4
2.12.0-3.3.1
fixed
suse enterprise server 12 SP5
2.12.0-3.3.1
fixed
suse enterprise workstation 12 SP3
2.12.0-1.33
fixed
suse enterprise workstation 12 SP4
2.12.0-3.3.1
fixed
suse enterprise workstation 12 SP5
2.12.0-3.3.1
fixed
libpurple-lang
suse enterprise desktop 12
2.10.9-5.15
fixed
suse enterprise desktop 12 SP1
2.10.9-8.1
fixed
suse enterprise desktop 12 SP2
2.11.0-12.5
fixed
suse enterprise desktop 12 SP3
2.12.0-1.33
fixed
suse enterprise desktop 12 SP4
2.12.0-3.3.1
fixed
suse enterprise sap 12
2.10.9-5.15
fixed
suse enterprise sap 12 SP1
2.10.9-8.1
fixed
suse enterprise sap 12 SP2
2.11.0-12.5
fixed
suse enterprise sap 12 SP3
2.12.0-1.33
fixed
suse enterprise sap 12 SP4
2.12.0-3.3.1
fixed
suse enterprise sap 12 SP5
2.12.0-3.3.1
fixed
suse enterprise server 12
2.10.9-5.15
fixed
suse enterprise server 12 SP1
2.10.9-8.1
fixed
suse enterprise server 12 SP2
2.11.0-12.5
fixed
suse enterprise server 12 SP3
2.12.0-1.33
fixed
suse enterprise server 12 SP4
2.12.0-3.3.1
fixed
suse enterprise server 12 SP5
2.12.0-3.3.1
fixed
suse enterprise workstation 12
2.10.9-5.15
fixed
suse enterprise workstation 12 SP1
2.10.9-8.1
fixed
suse enterprise workstation 12 SP2
2.11.0-12.5
fixed
suse enterprise workstation 12 SP3
2.12.0-1.33
fixed
suse enterprise workstation 12 SP4
2.12.0-3.3.1
fixed
suse enterprise workstation 12 SP5
2.12.0-3.3.1
fixed
libpurple-meanwhile
suse enterprise desktop 12
2.10.9-5.15
fixed
suse enterprise desktop 12 SP1
2.10.9-8.1
fixed
suse enterprise desktop 12 SP2
2.11.0-12.5
fixed
suse enterprise sap 12
2.10.9-5.15
fixed
suse enterprise sap 12 SP1
2.10.9-8.1
fixed
suse enterprise sap 12 SP2
2.11.0-12.5
fixed
suse enterprise server 12
2.10.9-5.15
fixed
suse enterprise server 12 SP1
2.10.9-8.1
fixed
suse enterprise server 12 SP2
2.11.0-12.5
fixed
suse enterprise workstation 12
2.10.9-5.15
fixed
suse enterprise workstation 12 SP1
2.10.9-8.1
fixed
suse enterprise workstation 12 SP2
2.11.0-12.5
fixed
libpurple-plugin-sametime
suse enterprise desktop 12 SP3
2.12.0-1.33
fixed
suse enterprise desktop 12 SP4
2.12.0-3.3.1
fixed
suse enterprise sap 12 SP3
2.12.0-1.33
fixed
suse enterprise sap 12 SP4
2.12.0-3.3.1
fixed
suse enterprise sap 12 SP5
2.12.0-3.3.1
fixed
suse enterprise server 12 SP3
2.12.0-1.33
fixed
suse enterprise server 12 SP4
2.12.0-3.3.1
fixed
suse enterprise server 12 SP5
2.12.0-3.3.1
fixed
suse enterprise workstation 12 SP3
2.12.0-1.33
fixed
suse enterprise workstation 12 SP4
2.12.0-3.3.1
fixed
suse enterprise workstation 12 SP5
2.12.0-3.3.1
fixed
libpurple-tcl
suse enterprise desktop 12
2.10.9-5.15
fixed
suse enterprise desktop 12 SP1
2.10.9-8.1
fixed
suse enterprise desktop 12 SP2
2.11.0-12.5
fixed
suse enterprise desktop 12 SP3
2.12.0-1.33
fixed
suse enterprise desktop 12 SP4
2.12.0-3.3.1
fixed
suse enterprise sap 12
2.10.9-5.15
fixed
suse enterprise sap 12 SP1
2.10.9-8.1
fixed
suse enterprise sap 12 SP2
2.11.0-12.5
fixed
suse enterprise sap 12 SP3
2.12.0-1.33
fixed
suse enterprise sap 12 SP4
2.12.0-3.3.1
fixed
suse enterprise sap 12 SP5
2.12.0-3.3.1
fixed
suse enterprise server 12
2.10.9-5.15
fixed
suse enterprise server 12 SP1
2.10.9-8.1
fixed
suse enterprise server 12 SP2
2.11.0-12.5
fixed
suse enterprise server 12 SP3
2.12.0-1.33
fixed
suse enterprise server 12 SP4
2.12.0-3.3.1
fixed
suse enterprise server 12 SP5
2.12.0-3.3.1
fixed
suse enterprise workstation 12
2.10.9-5.15
fixed
suse enterprise workstation 12 SP1
2.10.9-8.1
fixed
suse enterprise workstation 12 SP2
2.11.0-12.5
fixed
suse enterprise workstation 12 SP3
2.12.0-1.33
fixed
suse enterprise workstation 12 SP4
2.12.0-3.3.1
fixed
suse enterprise workstation 12 SP5
2.12.0-3.3.1
fixed
pidgin
suse enterprise desktop 12
2.10.9-5.15
fixed
suse enterprise desktop 12 SP1
2.10.9-8.1
fixed
suse enterprise desktop 12 SP2
2.11.0-12.5
fixed
suse enterprise desktop 12 SP3
2.12.0-1.33
fixed
suse enterprise desktop 12 SP4
2.12.0-3.3.1
fixed
suse enterprise sap 12
2.10.9-5.15
fixed
suse enterprise sap 12 SP1
2.10.9-8.1
fixed
suse enterprise sap 12 SP2
2.11.0-12.5
fixed
suse enterprise sap 12 SP3
2.12.0-1.33
fixed
suse enterprise sap 12 SP4
2.12.0-3.3.1
fixed
suse enterprise sap 12 SP5
2.12.0-3.3.1
fixed
suse enterprise server 12
2.10.9-5.15
fixed
suse enterprise server 12 SP1
2.10.9-8.1
fixed
suse enterprise server 12 SP2
2.11.0-12.5
fixed
suse enterprise server 12 SP3
2.12.0-1.33
fixed
suse enterprise server 12 SP4
2.12.0-3.3.1
fixed
suse enterprise server 12 SP5
2.12.0-3.3.1
fixed
suse enterprise workstation 12
2.10.9-5.15
fixed
suse enterprise workstation 12 SP1
2.10.9-8.1
fixed
suse enterprise workstation 12 SP2
2.11.0-12.5
fixed
suse enterprise workstation 12 SP3
2.12.0-1.33
fixed
suse enterprise workstation 12 SP4
2.12.0-3.3.1
fixed
suse enterprise workstation 12 SP5
2.12.0-3.3.1
fixed
Common Weakness Enumeration
References
http://developer.pidgin.im/wiki/ChangeLog
http://lists.fedoraproject.org/pipermail/package-announce/2010-February/035332.html
http://lists.fedoraproject.org/pipermail/package-announce/2010-February/035347.html
http://lists.fedoraproject.org/pipermail/package-announce/2010-February/035409.html
http://lists.opensuse.org/opensuse-security-announce/2010-03/msg00004.html
http://pidgin.im/news/security/?id=44
http://secunia.com/advisories/38563
http://secunia.com/advisories/38640
http://secunia.com/advisories/38658
http://secunia.com/advisories/38712
http://secunia.com/advisories/38915
http://secunia.com/advisories/39509
http://www.debian.org/security/2010/dsa-2038
http://www.mandriva.com/security/advisories?name=MDVSA-2010:041
http://www.mandriva.com/security/advisories?name=MDVSA-2010:085
http://www.osvdb.org/62439
http://www.securityfocus.com/bid/38294
http://www.ubuntu.com/usn/USN-902-1
http://www.vupen.com/english/advisories/2010/0413
http://www.vupen.com/english/advisories/2010/0914
http://www.vupen.com/english/advisories/2010/1020
https://bugzilla.redhat.com/show_bug.cgi?id=565786
https://exchange.xforce.ibmcloud.com/vulnerabilities/56399
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11485
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A18230
https://rhn.redhat.com/errata/RHSA-2010-0115.html
http://developer.pidgin.im/wiki/ChangeLog
http://lists.fedoraproject.org/pipermail/package-announce/2010-February/035332.html
http://lists.fedoraproject.org/pipermail/package-announce/2010-February/035347.html
http://lists.fedoraproject.org/pipermail/package-announce/2010-February/035409.html
http://lists.opensuse.org/opensuse-security-announce/2010-03/msg00004.html
http://pidgin.im/news/security/?id=44
http://secunia.com/advisories/38563
http://secunia.com/advisories/38640
http://secunia.com/advisories/38658
http://secunia.com/advisories/38712
http://secunia.com/advisories/38915
http://secunia.com/advisories/39509
http://www.debian.org/security/2010/dsa-2038
http://www.mandriva.com/security/advisories?name=MDVSA-2010:041
http://www.mandriva.com/security/advisories?name=MDVSA-2010:085
http://www.osvdb.org/62439
http://www.securityfocus.com/bid/38294
http://www.ubuntu.com/usn/USN-902-1
http://www.vupen.com/english/advisories/2010/0413
http://www.vupen.com/english/advisories/2010/0914
http://www.vupen.com/english/advisories/2010/1020
https://bugzilla.redhat.com/show_bug.cgi?id=565786
https://exchange.xforce.ibmcloud.com/vulnerabilities/56399
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11485
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A18230
https://rhn.redhat.com/errata/RHSA-2010-0115.html