{"id":"CVE-2017-2640","aliases":["ALPINE-CVE-2017-2640","DEBIAN-CVE-2017-2640","DLA-853-1","DSA-3806-1","EUVD-2017-11800","GHSA-556c-qpr9-626c","MGASA-2017-0102","RHSA-2017:1854","SUSE-SU-2018:2235-1","UBUNTU-CVE-2017-2640","USN-3231-1","openSUSE-SU-2024:11172-1"],"status":"published","title":"An out-of-bounds write flaw was found in the way Pidgin before 2.12.0 processed XML content. A...","description":"An out-of-bounds write flaw was found in the way Pidgin before 2.12.0 processed XML content. A malicious remote server could potentially use this flaw to crash Pidgin or execute arbitrary code in the context of the pidgin process.","severity":{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.06179,"percentile":0.93541,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-787"],"published":"2017-03-10T00:00:00Z","modified":"2026-09-01T20:03:05Z","fixes":[{"ecosystem":"Alpine:v3.2","package":"pidgin","fixed_in":["2.10.11-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.3","package":"pidgin","fixed_in":["2.10.11-r3"],"sources":["osv"]},{"ecosystem":"Alpine:v3.4","package":"pidgin","fixed_in":["2.11.0-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.5","package":"pidgin","fixed_in":["2.11.0-r1"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"pidgin","fixed_in":["2.12.0-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"pidgin","fixed_in":["2.12.0-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"pidgin","fixed_in":["2.12.0-1"],"sources":["osv"]},{"ecosystem":"Debian:7","package":"pidgin","fixed_in":["2.10.10-1~deb7u3"],"sources":["osv"]},{"ecosystem":"Debian:8","package":"pidgin","fixed_in":["2.11.0-0+deb8u2"],"sources":["osv"]},{"ecosystem":"Mageia:5","package":"pidgin","fixed_in":["2.12.0-1.mga5"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Software Development Kit 11 SP4","package":"pidgin","fixed_in":["2.6.6-0.30.3.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:14.04:LTS","package":"pidgin","fixed_in":["1:2.10.9-0ubuntu3.4"],"sources":["osv"]},{"ecosystem":"Ubuntu:16.04:LTS","package":"pidgin","fixed_in":["1:2.10.12-0ubuntu5.2"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.2","package":"pidgin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.10.11-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.3","package":"pidgin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.10.11-r3"}]}]},{"source":"osv","ecosystem":"Alpine:v3.4","package":"pidgin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.11.0-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.5","package":"pidgin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.11.0-r1"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"pidgin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.12.0-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"pidgin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.12.0-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"pidgin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.12.0-1"}]}]},{"source":"osv","ecosystem":"Debian:7","package":"pidgin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.10.10-1~deb7u3"}]}],"versions":["2.10.10-1~bpo60+1","2.10.10-1~deb7u1","2.10.10-1~deb7u2","2.10.6-3","2.10.7-1","2.10.7-2","2.10.7-2~bpo70+1","2.10.8-1","2.10.9-1","2.10.9-1~bpo60+1","2.10.9-1~deb7u1"]},{"source":"osv","ecosystem":"Debian:8","package":"pidgin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.11.0-0+deb8u2"}]}],"versions":["2.10.11-1","2.10.11-1.1","2.10.12-1","2.11.0-0+deb8u1"]},{"source":"osv","ecosystem":"Mageia:5","package":"pidgin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.12.0-1.mga5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"finch","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.10.11-5.el7"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"finch-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.10.11-5.el7"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"libpurple-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.10.11-5.el7"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"libpurple-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.10.11-5.el7"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"libpurple-tcl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.10.11-5.el7"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"pidgin-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.10.11-5.el7"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"pidgin-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.10.11-5.el7"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"pidgin-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.10.11-5.el7"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"libpurple","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.10.11-5.el7"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"pidgin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.10.11-5.el7"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"finch","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.10.11-5.el7"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"finch-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.10.11-5.el7"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"libpurple-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.10.11-5.el7"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"libpurple-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.10.11-5.el7"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"libpurple-tcl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.10.11-5.el7"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"pidgin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.10.11-5.el7"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"pidgin-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.10.11-5.el7"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"pidgin-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.10.11-5.el7"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"pidgin-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.10.11-5.el7"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"libpurple","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.10.11-5.el7"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"finch","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.10.11-5.el7"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"finch-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.10.11-5.el7"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"libpurple-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.10.11-5.el7"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"libpurple-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.10.11-5.el7"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"libpurple-tcl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.10.11-5.el7"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"pidgin-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.10.11-5.el7"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"pidgin-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.10.11-5.el7"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"pidgin-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.10.11-5.el7"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"libpurple","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.10.11-5.el7"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"pidgin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.10.11-5.el7"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 11 SP4","package":"pidgin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.6-0.30.3.1"}]}]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"pidgin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.10.9-0ubuntu3.4"}]}],"versions":["1:2.10.7-0ubuntu4.1","1:2.10.7-0ubuntu4.2","1:2.10.9-0ubuntu1","1:2.10.9-0ubuntu2","1:2.10.9-0ubuntu3","1:2.10.9-0ubuntu3.1","1:2.10.9-0ubuntu3.2","1:2.10.9-0ubuntu3.3"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"pidgin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.10.12-0ubuntu5.2"}]}],"versions":["1:2.10.11-0ubuntu4","1:2.10.11-0ubuntu5","1:2.10.12-0ubuntu1","1:2.10.12-0ubuntu2","1:2.10.12-0ubuntu3","1:2.10.12-0ubuntu4","1:2.10.12-0ubuntu5","1:2.10.12-0ubuntu5.1"]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"pidgin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.10.9-0ubuntu3.4"}]}],"versions":["1:2.10.7-0ubuntu4.1","1:2.10.7-0ubuntu4.2","1:2.10.9-0ubuntu1","1:2.10.9-0ubuntu2","1:2.10.9-0ubuntu3","1:2.10.9-0ubuntu3.1","1:2.10.9-0ubuntu3.2","1:2.10.9-0ubuntu3.3"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"pidgin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.14.7-1.1"}]}],"bundled":4}],"products":[{"vendor":"debian","product":"debian_linux"},{"vendor":"pidgin","product":"pidgin"},{"vendor":"redhat","product":"enterprise_linux_desktop"},{"vendor":"redhat","product":"enterprise_linux_server"},{"vendor":"redhat","product":"enterprise_linux_server_aus"},{"vendor":"redhat","product":"enterprise_linux_server_eus"},{"vendor":"redhat","product":"enterprise_linux_workstation"}],"references":[{"url":"https://security.gentoo.org/glsa/201706-10","tags":["vendor-advisory","x_refsource_GENTOO","x_transferred","Third Party Advisory","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2017:1854","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","Third Party Advisory","advisory"]},{"url":"http://www.securityfocus.com/bid/96775","tags":["vdb-entry","x_refsource_BID","x_transferred","Third Party Advisory","VDB Entry","advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-2640","tags":["x_refsource_CONFIRM","x_transferred","Issue Tracking","Patch","Third Party Advisory","fix"]},{"url":"https://www.debian.org/security/2017/dsa-3806","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-2640","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-556c-qpr9-626c"},{"url":"https://security.alpinelinux.org/vuln/CVE-2017-2640","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2017-2640","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2017-0102.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=20442","tags":["report"]},{"url":"http://pidgin.im/news/security/?id=109","tags":["web"]},{"url":"https://bitbucket.org/pidgin/www/src/tip/htdocs/ChangeLog?fileviewer=file-view-default","tags":["web"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/7/html/7.4_Release_Notes/index.html","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1154908","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1154909","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1154910","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1154911","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1369526","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1430019","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1439296","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1445921","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1446368","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2017/rhsa-2017_1854.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2014-3694","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2014-3694","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2014-3694","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2014-3695","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2014-3695","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2014-3695","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2014-3696","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2014-3696","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2014-3696","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2014-3698","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2014-3698","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2014-3698","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2017-2640","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2017-2640","tags":["advisory","report"]},{"url":"https://www.suse.com/support/update/announcement/2018/suse-su-20182235-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1028835","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2017-2640","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2017-2640","tags":["report"]},{"url":"https://www.pidgin.im/news/security/?id=109","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-3231-1","tags":["advisory"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2008-2927","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2008-2955","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2008-3532","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2017-2640","description":"An out-of-bounds write flaw was found in the way Pidgin before 2.12.0 processed XML content. A malicious remote server could potentially use this flaw to crash Pidgin or execute arbitrary code in the context of the pidgin process.","status":"published","published":"2018-07-27T18:00:00Z","modified":"2024-08-05T14:02:07.253Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-787"],"updated_at":"2026-11-02T14:33:15.543086Z"}],"euvd":[{"id":"EUVD-2017-11800","description":"An out-of-bounds write flaw was found in the way Pidgin before 2.12.0 processed XML content. A malicious remote server could potentially use this flaw to crash Pidgin or execute arbitrary code in the context of the pidgin process.","status":"published","published":"2018-07-27T18:00:00Z","modified":"2024-08-05T14:02:07Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-03T02:39:20.035866Z"}],"ghsa":[{"id":"GHSA-556c-qpr9-626c","title":"An out-of-bounds write flaw was found in the way Pidgin before 2.12.0 processed XML content. A...","description":"An out-of-bounds write flaw was found in the way Pidgin before 2.12.0 processed XML content. A malicious remote server could potentially use this flaw to crash Pidgin or execute arbitrary code in the context of the pidgin process.","status":"published","published":"2022-05-13T01:36:52Z","modified":"2023-02-01T05:09:03Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-787"],"updated_at":"2026-11-02T14:50:54.417127Z"}],"nvd":[{"id":"CVE-2017-2640","description":"An out-of-bounds write flaw was found in the way Pidgin before 2.12.0 processed XML content. A malicious remote server could potentially use this flaw to crash Pidgin or execute arbitrary code in the context of the pidgin process.","status":"published","published":"2018-07-27T18:29:00.97Z","modified":"2026-06-17T01:16:34.23Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"},{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"},{"version":"2.0","score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","level":"high","assessor":"primary"}],"cwes":["CWE-787"],"updated_at":"2026-11-02T14:04:18.679411Z"}],"osv":[{"id":"ALPINE-CVE-2017-2640","description":"An out-of-bounds write flaw was found in the way Pidgin before 2.12.0 processed XML content. A malicious remote server could potentially use this flaw to crash Pidgin or execute arbitrary code in the context of the pidgin process.","status":"published","published":"2018-07-27T18:29:00.97Z","modified":"2026-06-15T18:24:34.497614547Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:27:46.716249Z"},{"id":"CVE-2017-2640","description":"An out-of-bounds write flaw was found in the way Pidgin before 2.12.0 processed XML content. A malicious remote server could potentially use this flaw to crash Pidgin or execute arbitrary code in the context of the pidgin process.","status":"published","published":"2018-07-27T18:29:00.97Z","modified":"2026-04-16T06:17:15.27915525Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:44:05.486486Z"},{"id":"DEBIAN-CVE-2017-2640","description":"An out-of-bounds write flaw was found in the way Pidgin before 2.12.0 processed XML content. A malicious remote server could potentially use this flaw to crash Pidgin or execute arbitrary code in the context of the pidgin process.","status":"published","published":"2018-07-27T18:29:00.97Z","modified":"2026-09-01T20:03:05.320271105Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:45:29.100767Z"},{"id":"RHSA-2017:1854","title":"Red Hat Security Advisory: pidgin security, bug fix, and enhancement update","status":"published","published":"2024-09-15T23:55:18Z","modified":"2026-07-01T10:02:39Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:04.262457Z"},{"id":"UBUNTU-CVE-2017-2640","description":"An out-of-bounds write flaw was found in the way Pidgin before 2.12.0 processed XML content. A malicious remote server could potentially use this flaw to crash Pidgin or execute arbitrary code in the context of the pidgin process.","status":"published","published":"2017-03-10T00:00:00Z","modified":"2026-04-22T11:23:34.814564Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"},{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:54:14.977781Z"},{"id":"DLA-853-1","title":"pidgin - security update","status":"published","published":"2017-03-11T00:00:00Z","modified":"2026-03-09T02:09:53.047115Z","updated_at":"2026-11-02T15:46:13.584509Z"},{"id":"DSA-3806-1","title":"pidgin - security update","status":"published","published":"2017-03-10T00:00:00Z","modified":"2026-03-09T01:22:13.648185Z","updated_at":"2026-11-02T15:46:16.523846Z"},{"id":"MGASA-2017-0102","title":"Updated pidgin packages fix security vulnerability","description":"A server controlled by an attacker can send an invalid XML that can\ntrigger an out-of-bound memory access. This might lead to a crash or, in\nsome extreme cases, to remote code execution in the client-side\n(CVE-2017-2640).\n\nThe pidgin package has been updated to version 2.12.0, which fixes this\nissue and other bugs, including certificate validation for the Google Talk\nprotocol. It also removes protocol plugins for services that are no longer\navailable or supported.  See the upstream ChangeLog for details.\n","status":"published","published":"2017-04-04T06:44:05Z","modified":"2026-04-16T06:25:46.71866649Z","updated_at":"2026-11-02T15:49:40.103088Z"},{"id":"openSUSE-SU-2024:11172-1","title":"finch-2.14.7-1.1 on GA media","description":"These are all security issues fixed in the finch-2.14.7-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:40:17.145244Z","updated_at":"2026-11-02T16:58:34.894275Z"},{"id":"SUSE-SU-2018:2235-1","title":"Security update for pidgin","description":"This update for pidgin fixes the following issues:\n\nThe following security vulnerability was fixed:\n\n- CVE-2017-2640: Fixed an out of bound write in purple_markup_unescape_entity,\n  which could be triggered by a server controlled by an attacker and could\n  lead to crashes or, in some extreme cases, to remote code execution on the\n  client side (bsc#1028835).\n","status":"published","published":"2018-08-07T10:47:06Z","modified":"2026-02-04T03:22:50.872084Z","updated_at":"2026-11-02T15:53:44.972817Z"},{"id":"USN-3231-1","title":"pidgin vulnerability","description":"Joseph Bisch discovered that Pidgin incorrectly handled certain xml\nmessages. A remote attacker could use this issue to cause Pidgin to crash,\nresulting in a denial of service, or possibly execute arbitrary code.\n","status":"published","published":"2017-03-14T12:13:56Z","modified":"2026-04-22T09:32:52.304849Z","updated_at":"2026-11-02T16:58:10.303275Z"}]}}