CVE-2010-3711

Severity: medium (CVSS 4.0 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 3.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2010-10-28 · updated 2026-06-16
Weakness: CWE-20

Description

libpurple in Pidgin before 2.7.4 does not properly validate the return value of the purple_base64_decode function, which allows remote authenticated users to cause a denial of service (NULL pointer dereference and application crash) via a crafted message, related to the plugins for MSN, MySpaceIM, XMPP, and Yahoo! and the NTLM authentication support.

Affected products

Pidgin: through 2.7.3; 2.0.0, 2.0.1, 2.0.2, 2.1.0, 2.1.1, 2.2.0 (+27)

References

http://developer.pidgin.im/viewmtn/revision/info/b01c6a1f7fe4d86b83f5f10917b3cb713989cfcc
http://lists.fedoraproject.org/pipermail/package-announce/2010-November/050227.html
http://lists.fedoraproject.org/pipermail/package-announce/2010-November/050695.html
http://lists.fedoraproject.org/pipermail/package-announce/2010-October/050133.html
http://pidgin.im/news/security/?id=48
http://secunia.com/advisories/41893
http://secunia.com/advisories/41899
http://secunia.com/advisories/42075
http://secunia.com/advisories/42294
http://securitytracker.com/id?1024623
http://slackware.com/security/viewer.php?l=slackware-security&y=2010&m=slackware-security.462352
http://www.mandriva.com/security/advisories?name=MDVSA-2010:208

Get alerted when CVE-2010-3711 or the next vulnerability affects your stack