CVE-2011-3594

NameCVE-2011-3594
DescriptionThe g_markup_escape_text function in the SILC protocol plug-in in libpurple 2.10.0 and earlier, as used in Pidgin and possibly other products, allows remote attackers to cause a denial of service (crash) via invalid UTF-8 sequences that trigger use of invalid pointers and an out-of-bounds read, related to interactions with certain versions of glib2.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, Mageia, GitHub code/issues, web search, more)
NVD severitymedium (attack range: remote)

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
pidgin (PTS)jessie (security), jessie2.11.0-0+deb8u2fixed
stretch2.12.0-1fixed
buster, sid2.13.0-2fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
pidginsource(unstable)2.10.1-1unimportant
pidginsourcesqueeze2.7.3-1+squeeze2medium

Notes

relatively obscure client crash

Search for package or bug name: Reporting problems