---
title: "Pidgin Multiple Vulnerabilities Feb 2014 (Windows)"
url: https://securityorb.com/pidgin-multiple-vulnerabilities-feb-2014-windows/
type: post
date: 2015-06-04
modified: 2015-06-04
markdown_url: https://securityorb.com/pidgin-multiple-vulnerabilities-feb-2014-windows.md
author: "Kellep Charles"
---

# Pidgin Multiple Vulnerabilities Feb 2014 (Windows)

Vulnerability
Severity

Host
Location
Actions

[Pidgin Multiple Vulnerabilities Feb 2014 (Windows)](https://localhost:9392/omp?cmd=get_result&result_id=b50d353e-dad1-4c9d-aa6d-231c59e1324b&apply_overrides=&task_id=&name=&report_id=&filter=&filt_id=&overrides=&autofp=&report_result_id=b50d353e-dad1-4c9d-aa6d-231c59e1324b&token=686e8118-b20f-42a8-9134-0b5221418cc4)

10.0 (High)

192.168.1.10
general/tcp

[![Add Note](https://localhost:9392/img/new_note.png)](https://localhost:9392/omp?cmd=new_note&next=get_result&result_id=b50d353e-dad1-4c9d-aa6d-231c59e1324b&oid=1.3.6.1.4.1.25623.1.0.804314&task_id=72c159bb-278b-48d8-8a1f-85eb32e01115&name=MannyBoxScan&severity=10.0&port=general/tcp&hosts=192.168.1.10&report_id=72a4d326-5c66-4c69-8266-be0f6fcf2b9e&filter=sort-reverse%3Dseverity%20result_hosts_only%3D1%20min_cvss_base%3D%20levels%3Dhmlg%20autofp%3D0%20notes%3D1%20overrides%3D1%20first%3D1%20rows%3D100%20delta_states%3Dgn&filt_id=&apply_overrides=1&autofp=0&report_result_id=b50d353e-dad1-4c9d-aa6d-231c59e1324b&details=&token=686e8118-b20f-42a8-9134-0b5221418cc4)

[![Add Override](https://localhost:9392/img/new_override.png)](https://localhost:9392/omp?cmd=new_override&next=get_result&result_id=b50d353e-dad1-4c9d-aa6d-231c59e1324b&oid=1.3.6.1.4.1.25623.1.0.804314&task_id=72c159bb-278b-48d8-8a1f-85eb32e01115&name=MannyBoxScan&severity=10.0&port=general/tcp&hosts=192.168.1.10&report_id=72a4d326-5c66-4c69-8266-be0f6fcf2b9e&filter=sort-reverse%3Dseverity%20result_hosts_only%3D1%20min_cvss_base%3D%20levels%3Dhmlg%20autofp%3D0%20notes%3D1%20overrides%3D1%20first%3D1%20rows%3D100%20delta_states%3Dgn&filt_id=&apply_overrides=1&autofp=0&report_result_id=b50d353e-dad1-4c9d-aa6d-231c59e1324b&details=&token=686e8118-b20f-42a8-9134-0b5221418cc4)

**Summary**The host is installed with Pidgin and is prone to multiple vulnerabilities.

**Vulnerability Detection Result**Vulnerability was detected according to the Vulnerability Detection Method.

**Impact**Successful exploitation will allow remote attackers to conduct denial of service or execute arbitrary programs or spoof iq traffic.

Impact Level: System/Application

**Solution**Upgrade to Pidgin version 2.10.8 or later, For updates refer to http://www.pidgin.im/

**Vulnerability Insight**The flaws are due to an, - Improper validation of data by the Yahoo protocol plugin. - Improper validation of argument counts by IRC protocol plugin. - Improper validation of input to content-length header. - Integer signedness error in the 'MXit' functionality. - Integer overflow in 'ibpurple/protocols/gg/lib/http.c' in the 'Gadu-Gadu' (gg) parser. - Error due to incomplete fix for earlier flaw. - Integer overflow condition in the 'process_chunked_data' function in 'util.c'. - Error in 'STUN' protocol implementation in 'libpurple'. - Error in the 'XMPP' protocol plugin in 'libpurple'. - Error in the MSN module. - Improper validation of the length field in 'libpurple/protocols/yahoo/libymsg.c'. - Improper allocation of memory by 'util.c' in 'libpurple'. - Error in the libx11 library. - Multiple integer signedness errors in libpurple.

**Vulnerability Detection Method**Get the installed version with the help of detect NVT and check the version is vulnerable or not.

Details: [Pidgin Multiple Vulnerabilities Feb 2014 (Windows) (OID: 1.3.6.1.4.1.25623.1.0.804314)](https://localhost:9392/omp?cmd=get_nvts&oid=1.3.6.1.4.1.25623.1.0.804314&token=686e8118-b20f-42a8-9134-0b5221418cc4)

Version used: $Revision: 302 $

**References**

CVE:
[CVE-2012-6152](https://localhost:9392/omp?cmd=get_info&info_type=cve&info_name=CVE-2012-6152&details=1&filter=&filt_id=&token=686e8118-b20f-42a8-9134-0b5221418cc4), [CVE-2013-6477](https://localhost:9392/omp?cmd=get_info&info_type=cve&info_name=CVE-2013-6477&details=1&filter=&filt_id=&token=686e8118-b20f-42a8-9134-0b5221418cc4), [CVE-2013-6478](https://localhost:9392/omp?cmd=get_info&info_type=cve&info_name=CVE-2013-6478&details=1&filter=&filt_id=&token=686e8118-b20f-42a8-9134-0b5221418cc4), [CVE-2013-6479](https://localhost:9392/omp?cmd=get_info&info_type=cve&info_name=CVE-2013-6479&details=1&filter=&filt_id=&token=686e8118-b20f-42a8-9134-0b5221418cc4), [CVE-2013-6481](https://localhost:9392/omp?cmd=get_info&info_type=cve&info_name=CVE-2013-6481&details=1&filter=&filt_id=&token=686e8118-b20f-42a8-9134-0b5221418cc4), [CVE-2013-6482](https://localhost:9392/omp?cmd=get_info&info_type=cve&info_name=CVE-2013-6482&details=1&filter=&filt_id=&token=686e8118-b20f-42a8-9134-0b5221418cc4), [CVE-2013-6483](https://localhost:9392/omp?cmd=get_info&info_type=cve&info_name=CVE-2013-6483&details=1&filter=&filt_id=&token=686e8118-b20f-42a8-9134-0b5221418cc4), [CVE-2013-6484](https://localhost:9392/omp?cmd=get_info&info_type=cve&info_name=CVE-2013-6484&details=1&filter=&filt_id=&token=686e8118-b20f-42a8-9134-0b5221418cc4), [CVE-2013-6485](https://localhost:9392/omp?cmd=get_info&info_type=cve&info_name=CVE-2013-6485&details=1&filter=&filt_id=&token=686e8118-b20f-42a8-9134-0b5221418cc4), [CVE-2013-6486](https://localhost:9392/omp?cmd=get_info&info_type=cve&info_name=CVE-2013-6486&details=1&filter=&filt_id=&token=686e8118-b20f-42a8-9134-0b5221418cc4), [CVE-2013-6487](https://localhost:9392/omp?cmd=get_info&info_type=cve&info_name=CVE-2013-6487&details=1&filter=&filt_id=&token=686e8118-b20f-42a8-9134-0b5221418cc4), [CVE-2013-6489](https://localhost:9392/omp?cmd=get_info&info_type=cve&info_name=CVE-2013-6489&details=1&filter=&filt_id=&token=686e8118-b20f-42a8-9134-0b5221418cc4), [CVE-2013-6490](https://localhost:9392/omp?cmd=get_info&info_type=cve&info_name=CVE-2013-6490&details=1&filter=&filt_id=&token=686e8118-b20f-42a8-9134-0b5221418cc4), [CVE-2014-0020](https://localhost:9392/omp?cmd=get_info&info_type=cve&info_name=CVE-2014-0020&details=1&filter=&filt_id=&token=686e8118-b20f-42a8-9134-0b5221418cc4)

BID:
65492, 65243, 65189, 65188, 65192, 65195

CERT:
[DFN-CERT-2014-0676](https://localhost:9392/omp?cmd=get_info&info_type=dfn_cert_adv&info_name=DFN-CERT-2014-0676&details=1&filter=&token=686e8118-b20f-42a8-9134-0b5221418cc4), [DFN-CERT-2014-0160](https://localhost:9392/omp?cmd=get_info&info_type=dfn_cert_adv&info_name=DFN-CERT-2014-0160&details=1&filter=&token=686e8118-b20f-42a8-9134-0b5221418cc4), [DFN-CERT-2014-0123](https://localhost:9392/omp?cmd=get_info&info_type=dfn_cert_adv&info_name=DFN-CERT-2014-0123&details=1&filter=&token=686e8118-b20f-42a8-9134-0b5221418cc4)

Other:
http://www.osvdb.com/102622

http://www.osvdb.com/102616

http://secunia.com/advisories/56693/

http://www.pidgin.im/news/security/?id=70

http://www.pidgin.im/news/security/?id=85