Talos Discovered Three More Vulnerabilities in Pidgin
Summary: Cisco Talos disclosed three more CVEs in Pidgin, found during its initial look at the client that produced four vulnerabilities released in January, and patched in Pidgin 2.10.10. CVE-2014-3697 lets a theme or smiley TAR package write or overwrite any file the user's permissions allow on Windows, CVE-2014-3696 lets a Novell Groupwise message trigger an out-of-memory exception via a large allocation size, and CVE-2014-3695 lets a spoofed Mxit emoticon cause an out-of-bounds read of up to 2GB.
What's compelling: The Windows flaw bypasses the absolute-path check because a path like c:/path/file.ext passes g_fopen(), so a dragged-in theme package can overwrite files under the user's own permissions. The Mxit bug needs an attacker able to spoof messages from the mxit.com domain, and its impact is limited to denial of service.
Read the original at Cisco Talos ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2014-3695CVE-2014-3696CVE-2014-3697
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026