CVE-2014-3698

Name of the Vulnerable Software and Affected Versions Pidgin versions prior to 2.10.10

Description The issue allows remote attackers to obtain sensitive information from process memory via a crafted XMPP message. This is due to a problem in the jabber idn validate function in jutil.c in the Jabber protocol plugin in libpurple.

Recommendations For versions prior to 2.10.10, update to version 2.10.10 or later to resolve the issue. As a temporary workaround, consider disabling the jabber idn validate function until a patch is available. Restrict access to the Jabber protocol plugin to minimize the risk of exploitation.