CVE-2011-2943

pidgin: Crash in IRC protocol plug-in by listing set of users (/who command) upon session startup

Published Aug 29, 2011 CVSS 2.0 · 4.3 Medium EPSS 3.6% KEV · Not listed
Description
The irc_msg_who function in msgs.c in the IRC protocol plugin in libpurple 2.8.0 through 2.9.0 in Pidgin before 2.10.0 does not properly validate characters in nicknames, which allows user-assisted remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted nickname that is not properly handled in a WHO response.

Remediation

No solution or workaround provided in the CVE record

Tracking

Sign in to view the affected projects.

Advisories

Source ID Title
EUVD EUVD EUVD-2011-2911 The irc_msg_who function in msgs.c in the IRC protocol plugin in libpurple 2.8.0 through 2.9.0 in Pidgin before 2.10.0 does not properly validate characters in nicknames, which allows user-assisted remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted nickname that is not properly handled in a WHO response.
History

No history.

Weaknesses

Sources

Status
PUBLISHED
Assigner
redhat
Published
Updated
Aug 6, 2024, 11:15 PM
Reserved
Jul 27, 2011, 12:00 AM
Status
Modified
Published
Aug 29, 2011, 5:55 PM
Modified
Jun 16, 2026, 11:32 PM
Severity
Low
Public date
Jul 20, 2011, 12:00 AM