Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
5.0

Pidgin before 2.10.4 can crash when receiving malicious MSN messages

CVE-2012-2318 · published 14 years ago
Summary

The Pidgin instant‑messaging program’s MSN chat add‑on can mishandle certain characters in plain‑text messages. A remote server that sends a specially crafted message can make the application stop working, effectively denying service to the user. Upgrade Pidgin to version 2.10.4 or later, or discontinue use of the MSN plugin, to prevent the crash.

What to do
  • Update debian pidgin to version 2.10.4-1.
Affected software
Ecosystem VendorProductAffected versions
Debian:12 debian pidgin < 2.10.4-1
Fix: upgrade to 2.10.4-1
Debian:13 debian pidgin < 2.10.4-1
Fix: upgrade to 2.10.4-1
Debian:14 debian pidgin < 2.10.4-1
Fix: upgrade to 2.10.4-1
– pidgin pidgin <= 2.10.3
2.0.0
2.0.1
2.0.2
2.1.0
2.1.1
2.2.0
2.2.1
2.2.2
2.3.0
2.3.1
2.4.0
36 more version ranges
cpe:2.3:a:pidgin:pidgin:*:*:*:*:*:*:*:*
Original advisory text
msg.c in the MSN protocol plugin in libpurple in Pidgin before 2.10.4 does not properly handle crafted characters, which allows remote servers to cause a denial of service (application crash) by pl...
msg.c in the MSN protocol plugin in libpurple in Pidgin before 2.10.4 does not properly handle crafted characters, which allows remote servers to cause a denial of service (application crash) by placing these characters in a text/plain message.
References
Severity
5.0 Medium
Exploitation
2% chance of attack within 30 days
Type
CWE-20Improper Input Validation
Timeline
Published3 Jul 2012
Updated3 Nov 2026
First seen5 Sep 2026
Sources
DEBIAN-CVE-2012-2318 · OSV
CVE-2012-2318 · NVD
Track software like this
Free during beta