CVE-2019-25544

EUVD-2019-19837
Pidgin 2.13.0 contains a denial of service vulnerability that allows local attackers to crash the application by providing an excessively long username string during account creation. Attackers can input a buffer of 1000 characters in the username field and trigger a crash when joining a chat, causing the application to become unavailable.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
6.2 MEDIUM
LOCAL
LOW
NONE
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: 8.5%
Affected Products (NVD)
VendorProductVersion
pidginpidgin
2.13.0
𝑥
= Vulnerable software versions
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
pidgin
bionic
needs-triage
focal
needs-triage
jammy
needs-triage
noble
needs-triage
questing
needs-triage
trusty
needs-triage
xenial
needs-triage
openSUSE logo
openSUSE / SLES Releases
openSUSE Product
Release
farstream-data
suse enterprise server 12 SP5
0.2.8-5.2.4
fixed
farstream-devel
suse enterprise server 12 SP5
0.2.8-5.2.4
fixed
finch
suse enterprise server 12 SP5
2.14.8-3.9.3
fixed
finch-devel
suse enterprise server 12 SP5
2.14.8-3.9.3
fixed
gstreamer-plugins-farstream
suse enterprise server 12 SP5
0.2.8-5.2.4
fixed
libfarstream-0_2-5
suse enterprise server 12 SP5
0.2.8-5.2.4
fixed
libgnt-devel
suse enterprise server 12 SP5
2.14.3-4.3.8
fixed
libgnt0
suse enterprise server 12 SP5
2.14.3-4.3.8
fixed
libgnt0-32bit
suse enterprise server 12 SP5
2.14.3-4.3.8
fixed
libgssdp-1_0-3
suse enterprise server 12 SP5
0.14.16-7.2.1
fixed
libgssdp-devel
suse enterprise server 12 SP5
0.14.16-7.2.1
fixed
libgupnp-1_0-4
suse enterprise server 12 SP5
0.20.18-8.5.2
fixed
libgupnp-devel
suse enterprise server 12 SP5
0.20.18-8.5.2
fixed
libgupnp-igd-1_0-4
suse enterprise server 12 SP5
0.2.4-6.2.2
fixed
libgupnp-igd-devel
suse enterprise server 12 SP5
0.2.4-6.2.2
fixed
libnice-devel
suse enterprise server 12 SP5
0.1.13-7.2.3
fixed
libnice10
suse enterprise server 12 SP5
0.1.13-7.2.3
fixed
libpurple
suse enterprise server 12 SP5
2.14.8-3.9.3
fixed
libpurple-branding-upstream
suse enterprise server 12 SP5
2.14.8-3.9.3
fixed
libpurple-client0
suse enterprise server 12 SP5
2.14.8-3.9.3
fixed
libpurple-devel
suse enterprise server 12 SP5
2.14.8-3.9.3
fixed
libpurple-lang
suse enterprise server 12 SP5
2.14.8-3.9.3
fixed
libpurple-tcl
suse enterprise server 12 SP5
2.14.8-3.9.3
fixed
libpurple0
suse enterprise server 12 SP5
2.14.8-3.9.3
fixed
pidgin-devel
suse enterprise server 12 SP5
2.14.8-3.9.3
fixed
typelib-1_0-Farstream-0_2
suse enterprise server 12 SP5
0.2.8-5.2.4
fixed
typelib-1_0-GSSDP-1_0
suse enterprise server 12 SP5
0.14.16-7.2.1
fixed
typelib-1_0-GUPnP-1_0
suse enterprise server 12 SP5
0.20.18-8.5.2
fixed
typelib-1_0-GUPnPIgd-1_0
suse enterprise server 12 SP5
0.2.4-6.2.2
fixed
Common Weakness Enumeration
References
https://pidgin.im/
https://www.exploit-db.com/exploits/46930
https://www.vulncheck.com/advisories/pidgin-denial-of-service-via-malformed-username