CVE-2008-3532
The NSS plugin in libpurple in Pidgin 2.4.3 does not verify SSL certificates, which makes it...
6.8 MediumFix available
The NSS plugin in libpurple in Pidgin 2.4.3 does not verify SSL certificates, which makes it easier for remote attackers to trick a user into accepting an invalid server certificate for a spoofed service.
Exploit likelihood
1.64%Down 2.1 points since Feb 4, 2022
What each source reports
NVD Score used
The NSS plugin in libpurple in Pidgin 2.4.3 does not verify SSL certificates, which makes it easier for remote attackers to trick a user into accepting an invalid server certificate for a spoofed service.
- Record
CVE-2008-3532- CVSS 2.0
- 6.8 Medium
AV:N/AC:M/Au:N/C:P/I:P/A:P - Weakness
- CWE-310
- Updated
- 2026-11-02
CVE List No score
The NSS plugin in libpurple in Pidgin 2.4.3 does not verify SSL certificates, which makes it easier for remote attackers to trick a user into accepting an invalid server certificate for a spoofed service.
- Record
CVE-2008-3532- Updated
- 2026-11-02
EUVDEUVD-2008-3518 No score
The NSS plugin in libpurple in Pidgin 2.4.3 does not verify SSL certificates, which makes it easier for remote attackers to trick a user into accepting an invalid server certificate for a spoofed service.
- Record
EUVD-2008-3518- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-ww4m-hgqp-q9hp No score
The NSS plugin in libpurple in Pidgin 2.4.3 does not verify SSL certificates, which makes it...
The NSS plugin in libpurple in Pidgin 2.4.3 does not verify SSL certificates, which makes it easier for remote attackers to trick a user into accepting an invalid server certificate for a spoofed service.
- Record
GHSA-ww4m-hgqp-q9hp- Updated
- 2026-11-02
OSV No score
The NSS plugin in libpurple in Pidgin 2.4.3 does not verify SSL certificates, which makes it easier for remote attackers to trick a user into accepting an invalid server certificate for a spoofed service.
- Record
CVE-2008-3532- Updated
- 2026-11-02
OSVDEBIAN-CVE-2008-3532 No score
The NSS plugin in libpurple in Pidgin 2.4.3 does not verify SSL certificates, which makes it easier for remote attackers to trick a user into accepting an invalid server certificate for a spoofed service.
- Record
DEBIAN-CVE-2008-3532- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:11172-1 No score
finch-2.14.7-1.1 on GA media
These are all security issues fixed in the finch-2.14.7-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:11172-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
pidginDebian:12 |
before 2.4.3-2 | 2.4.3-2 |
pidginDebian:13 |
before 2.4.3-2 | 2.4.3-2 |
pidginDebian:14 |
before 2.4.3-2 | 2.4.3-2 |
finchRed Hat:enterprise_linux:4::as From an advisory covering 3 CVEs |
before 0:2.5.2-6.el4 | 0:2.5.2-6.el4 |
finch-develRed Hat:enterprise_linux:4::as From an advisory covering 3 CVEs |
before 0:2.5.2-6.el4 | 0:2.5.2-6.el4 |
libpurpleRed Hat:enterprise_linux:4::as From an advisory covering 3 CVEs |
before 0:2.5.2-6.el4 | 0:2.5.2-6.el4 |
libpurple-develRed Hat:enterprise_linux:4::as From an advisory covering 3 CVEs |
before 0:2.5.2-6.el4 | 0:2.5.2-6.el4 |
libpurple-perlRed Hat:enterprise_linux:4::as From an advisory covering 3 CVEs |
before 0:2.5.2-6.el4 | 0:2.5.2-6.el4 |
libpurple-tclRed Hat:enterprise_linux:4::as From an advisory covering 3 CVEs |
before 0:2.5.2-6.el4 | 0:2.5.2-6.el4 |
pidginRed Hat:enterprise_linux:4::as From an advisory covering 3 CVEs |
before 0:2.5.2-6.el4 | 0:2.5.2-6.el4 |
Show 56 moreShow less
| Package | Affected | Fixed |
|---|---|---|
pidgin-debuginfoRed Hat:enterprise_linux:4::as From an advisory covering 3 CVEs |
before 0:2.5.2-6.el4 | 0:2.5.2-6.el4 |
pidgin-develRed Hat:enterprise_linux:4::as From an advisory covering 3 CVEs |
before 0:2.5.2-6.el4 | 0:2.5.2-6.el4 |
pidgin-perlRed Hat:enterprise_linux:4::as From an advisory covering 3 CVEs |
before 0:2.5.2-6.el4 | 0:2.5.2-6.el4 |
finchRed Hat:enterprise_linux:4::desktop From an advisory covering 3 CVEs |
before 0:2.5.2-6.el4 | 0:2.5.2-6.el4 |
finch-develRed Hat:enterprise_linux:4::desktop From an advisory covering 3 CVEs |
before 0:2.5.2-6.el4 | 0:2.5.2-6.el4 |
libpurpleRed Hat:enterprise_linux:4::desktop From an advisory covering 3 CVEs |
before 0:2.5.2-6.el4 | 0:2.5.2-6.el4 |
libpurple-develRed Hat:enterprise_linux:4::desktop From an advisory covering 3 CVEs |
before 0:2.5.2-6.el4 | 0:2.5.2-6.el4 |
libpurple-perlRed Hat:enterprise_linux:4::desktop From an advisory covering 3 CVEs |
before 0:2.5.2-6.el4 | 0:2.5.2-6.el4 |
libpurple-tclRed Hat:enterprise_linux:4::desktop From an advisory covering 3 CVEs |
before 0:2.5.2-6.el4 | 0:2.5.2-6.el4 |
pidginRed Hat:enterprise_linux:4::desktop From an advisory covering 3 CVEs |
before 0:2.5.2-6.el4 | 0:2.5.2-6.el4 |
pidgin-debuginfoRed Hat:enterprise_linux:4::desktop From an advisory covering 3 CVEs |
before 0:2.5.2-6.el4 | 0:2.5.2-6.el4 |
pidgin-develRed Hat:enterprise_linux:4::desktop From an advisory covering 3 CVEs |
before 0:2.5.2-6.el4 | 0:2.5.2-6.el4 |
pidgin-perlRed Hat:enterprise_linux:4::desktop From an advisory covering 3 CVEs |
before 0:2.5.2-6.el4 | 0:2.5.2-6.el4 |
finchRed Hat:enterprise_linux:4::es From an advisory covering 3 CVEs |
before 0:2.5.2-6.el4 | 0:2.5.2-6.el4 |
finch-develRed Hat:enterprise_linux:4::es From an advisory covering 3 CVEs |
before 0:2.5.2-6.el4 | 0:2.5.2-6.el4 |
libpurpleRed Hat:enterprise_linux:4::es From an advisory covering 3 CVEs |
before 0:2.5.2-6.el4 | 0:2.5.2-6.el4 |
libpurple-develRed Hat:enterprise_linux:4::es From an advisory covering 3 CVEs |
before 0:2.5.2-6.el4 | 0:2.5.2-6.el4 |
libpurple-perlRed Hat:enterprise_linux:4::es From an advisory covering 3 CVEs |
before 0:2.5.2-6.el4 | 0:2.5.2-6.el4 |
libpurple-tclRed Hat:enterprise_linux:4::es From an advisory covering 3 CVEs |
before 0:2.5.2-6.el4 | 0:2.5.2-6.el4 |
pidginRed Hat:enterprise_linux:4::es From an advisory covering 3 CVEs |
before 0:2.5.2-6.el4 | 0:2.5.2-6.el4 |
pidgin-debuginfoRed Hat:enterprise_linux:4::es From an advisory covering 3 CVEs |
before 0:2.5.2-6.el4 | 0:2.5.2-6.el4 |
pidgin-develRed Hat:enterprise_linux:4::es From an advisory covering 3 CVEs |
before 0:2.5.2-6.el4 | 0:2.5.2-6.el4 |
pidgin-perlRed Hat:enterprise_linux:4::es From an advisory covering 3 CVEs |
before 0:2.5.2-6.el4 | 0:2.5.2-6.el4 |
finchRed Hat:enterprise_linux:4::ws From an advisory covering 3 CVEs |
before 0:2.5.2-6.el4 | 0:2.5.2-6.el4 |
finch-develRed Hat:enterprise_linux:4::ws From an advisory covering 3 CVEs |
before 0:2.5.2-6.el4 | 0:2.5.2-6.el4 |
libpurpleRed Hat:enterprise_linux:4::ws From an advisory covering 3 CVEs |
before 0:2.5.2-6.el4 | 0:2.5.2-6.el4 |
libpurple-develRed Hat:enterprise_linux:4::ws From an advisory covering 3 CVEs |
before 0:2.5.2-6.el4 | 0:2.5.2-6.el4 |
libpurple-perlRed Hat:enterprise_linux:4::ws From an advisory covering 3 CVEs |
before 0:2.5.2-6.el4 | 0:2.5.2-6.el4 |
libpurple-tclRed Hat:enterprise_linux:4::ws From an advisory covering 3 CVEs |
before 0:2.5.2-6.el4 | 0:2.5.2-6.el4 |
pidginRed Hat:enterprise_linux:4::ws From an advisory covering 3 CVEs |
before 0:2.5.2-6.el4 | 0:2.5.2-6.el4 |
pidgin-debuginfoRed Hat:enterprise_linux:4::ws From an advisory covering 3 CVEs |
before 0:2.5.2-6.el4 | 0:2.5.2-6.el4 |
pidgin-develRed Hat:enterprise_linux:4::ws From an advisory covering 3 CVEs |
before 0:2.5.2-6.el4 | 0:2.5.2-6.el4 |
pidgin-perlRed Hat:enterprise_linux:4::ws From an advisory covering 3 CVEs |
before 0:2.5.2-6.el4 | 0:2.5.2-6.el4 |
finch-develRed Hat:enterprise_linux:5::client_workstation From an advisory covering 3 CVEs |
before 0:2.5.2-6.el5 | 0:2.5.2-6.el5 |
libpurple-develRed Hat:enterprise_linux:5::client_workstation From an advisory covering 3 CVEs |
before 0:2.5.2-6.el5 | 0:2.5.2-6.el5 |
pidginRed Hat:enterprise_linux:5::client_workstation From an advisory covering 3 CVEs |
before 0:2.5.2-6.el5 | 0:2.5.2-6.el5 |
pidgin-debuginfoRed Hat:enterprise_linux:5::client_workstation From an advisory covering 3 CVEs |
before 0:2.5.2-6.el5 | 0:2.5.2-6.el5 |
pidgin-develRed Hat:enterprise_linux:5::client_workstation From an advisory covering 3 CVEs |
before 0:2.5.2-6.el5 | 0:2.5.2-6.el5 |
finchRed Hat:enterprise_linux:5::client From an advisory covering 3 CVEs |
before 0:2.5.2-6.el5 | 0:2.5.2-6.el5 |
libpurpleRed Hat:enterprise_linux:5::client From an advisory covering 3 CVEs |
before 0:2.5.2-6.el5 | 0:2.5.2-6.el5 |
libpurple-perlRed Hat:enterprise_linux:5::client From an advisory covering 3 CVEs |
before 0:2.5.2-6.el5 | 0:2.5.2-6.el5 |
libpurple-tclRed Hat:enterprise_linux:5::client From an advisory covering 3 CVEs |
before 0:2.5.2-6.el5 | 0:2.5.2-6.el5 |
pidginRed Hat:enterprise_linux:5::client From an advisory covering 3 CVEs |
before 0:2.5.2-6.el5 | 0:2.5.2-6.el5 |
pidgin-debuginfoRed Hat:enterprise_linux:5::client From an advisory covering 3 CVEs |
before 0:2.5.2-6.el5 | 0:2.5.2-6.el5 |
pidgin-perlRed Hat:enterprise_linux:5::client From an advisory covering 3 CVEs |
before 0:2.5.2-6.el5 | 0:2.5.2-6.el5 |
finchRed Hat:rhel_productivity:5 From an advisory covering 3 CVEs |
before 0:2.5.2-6.el5 | 0:2.5.2-6.el5 |
finch-develRed Hat:rhel_productivity:5 From an advisory covering 3 CVEs |
before 0:2.5.2-6.el5 | 0:2.5.2-6.el5 |
libpurpleRed Hat:rhel_productivity:5 From an advisory covering 3 CVEs |
before 0:2.5.2-6.el5 | 0:2.5.2-6.el5 |
libpurple-develRed Hat:rhel_productivity:5 From an advisory covering 3 CVEs |
before 0:2.5.2-6.el5 | 0:2.5.2-6.el5 |
libpurple-perlRed Hat:rhel_productivity:5 From an advisory covering 3 CVEs |
before 0:2.5.2-6.el5 | 0:2.5.2-6.el5 |
libpurple-tclRed Hat:rhel_productivity:5 From an advisory covering 3 CVEs |
before 0:2.5.2-6.el5 | 0:2.5.2-6.el5 |
pidginRed Hat:rhel_productivity:5 From an advisory covering 3 CVEs |
before 0:2.5.2-6.el5 | 0:2.5.2-6.el5 |
pidgin-debuginfoRed Hat:rhel_productivity:5 From an advisory covering 3 CVEs |
before 0:2.5.2-6.el5 | 0:2.5.2-6.el5 |
pidgin-develRed Hat:rhel_productivity:5 From an advisory covering 3 CVEs |
before 0:2.5.2-6.el5 | 0:2.5.2-6.el5 |
pidgin-perlRed Hat:rhel_productivity:5 From an advisory covering 3 CVEs |
before 0:2.5.2-6.el5 | 0:2.5.2-6.el5 |
pidginopenSUSE:Tumbleweed From an advisory covering 4 CVEs |
before 2.14.7-1.1 | 2.14.7-1.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2008-3532 is a medium vulnerability (CVSS 6.8) in Pidgin, published August 8, 2008. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.64%, the 76th percentile. Fixed in pidgin 2.4.3-2.
References
developer.pidgin.im/attachment/ticket/6500/nss-cert-verify.patch
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A18327
mandriva.com/security/advisories?name=MDVSA-2009:025
secunia.com/advisories/31390
vupen.com/english/advisories/2008/2318
support.avaya.com/elmodocs2/security/ASA-2008-493.htm
Show 35 moreShow less
bugs.debian.org/cgi-bin/bugreport.cgi?bug=492434
ubuntu.com/usn/USN-675-1
exchange.xforce.ibmcloud.com/vulnerabilities/44220
redhat.com/support/errata/RHSA-2008-1023.html
securityfocus.com/bid/30553
nvd.nist.gov/vuln/detail/CVE-2008-3532
github.com/advisories/GHSA-ww4m-hgqp-q9hp
security-tracker.debian.org/tracker/CVE-2008-3532
access.redhat.com/errata/RHSA-2008:1023
bugzilla.redhat.com/show_bug.cgi?id=474212
security.access.redhat.com/data/csaf/v2/advisories/2008/rhsa-2008_1023.json
cve.org/CVERecord?id=CVE-2008-2955
suse.com/security/cve/CVE-2008-2927