The XMPP protocol plugin in libpurple in Pidgin before 2.10.8 does not properly determine whether the from address in an iq reply is consistent with the to address in an iq request, which allows remote attackers to spoof iq traffic or cause a denial of service (NULL pointer dereference and application crash) via a crafted reply.

The XMPP protocol plugin in libpurple in Pidgin before 2.10.8 does not properly determine whether the from address in an iq reply is consistent with the to address in an iq request, which allows remote attackers to spoof iq traffic or cause a denial of service (NULL pointer dereference and application crash) via a crafted reply.

finch-2.11.0-4.1 on GA media

pidgin: DoS when decoding non-UTF-8 strings in Yahoo protocol plugin pidgin: DoS when handling timestamps in the XMPP plugin pidgin: DoS when rendering long URLs pidgin: DoS when parsing certain HTTP response headers pidgin: DoS caused due to OOB read in Yahoo protocol plugin pidgin: DoS via multiple null pointer dereferences in MSN protocol plugin pidgin: Possible spoofing using iq replies in XMPP protocol plugin pidgin: DoS via specially-crafted stun messages pidgin: Heap-based buffer overflow when parsing chunked HTTP responses pidgin: Heap-based buffer overflow in Gadu-Gadu protocol plugin pidgin: Heap-based buffer overflow in MXit emoticon parsing pidgin: Heap-based buffer overflow in SIMPLE protocol plugin pidgin: DoS in IRC protocol plugin due to arguement parsing