huzaifas-sidhpurwala/security-commit huggingface dataset:
CVE-2013-6447: Seam: XML eXternal Entity (XXE) flaw in remoting
Component: Seam
Severity: Moderate
CWE: CWE-611 (Improper Restriction of XML External Entity Reference)
Public date: 2014-01-20T00:00:00+00:00

Multiple XML External Entity (XXE) vulnerabilities in the (1) ExecutionHandler, (2) PollHandler, and (3) SubscriptionHandler classes in JBoss Seam Remoting in JBoss Seam 2 framework 2.3.1 and earlier, as used in JBoss Web Framework Kit, allow remote attackers to read arbitrary files and possibly have other impacts via a crafted XML file.

Statement: This issue affects Seam 3 remoting, but Seam 3 is not shipped with any Red Hat products, and Seam 3 development has been terminated. This issue is not currently planned to be addressed in a future update to Seam 3.

Red Hat JBoss BRMS 5; Red Hat JBoss Enterprise Application Platform 4 and 5; Red Hat JBoss Enterprise Portal Platform 5; Red Hat JBoss Enterprise SOA Platform 4 and 5; and Red Hat JBoss Enterprise Web Platform 5 are now in Phase 3, Extended Life Support, of their respective life cycles. This issue has been rated as having Moderate security impact and is not currently planned to be addressed in future updates. For additional information, refer to the Red Hat JBoss Middleware and Red Hat JBoss Operations Network Product Update and Support Policy: https://access.redhat.com/support/policy/updates/jboss_notes/

Affected upstream versions: n/a
Upstream repository: https://github.com/seam2/jboss-seam
Upstream fix commit: 090aa6252affc978a96c388e3fc2c1c2688d9bb5
CVE-2013-6448: Seam: Information disclosure in remoting
Component: Seam
Severity: Low
CWE: CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor)
Public date: 2014-01-20T00:00:00+00:00

The InterfaceGenerator handler in JBoss Seam Remoting in JBoss Seam 2 framework 2.3.1 and earlier, as used in JBoss Web Framework Kit, allows remote attackers to bypass the WebRemote annotation restriction and obtain information about arbitrary classes and methods on the server classpath via unspecified vectors.

Statement: Red Hat JBoss BRMS 5; Red Hat JBoss Enterprise Application Platform 4 and 5; Red Hat JBoss Enterprise Portal Platform 5; Red Hat JBoss Enterprise SOA Platform 4 and 5; and Red Hat JBoss Enterprise Web Platform 5 are now in Phase 3, Extended Life Support, of their respective life cycles. This issue has been rated as having Low security impact and is not currently planned to be addressed in future updates. For additional information, refer to the Red Hat JBoss Middleware and Red Hat JBoss Operations Network Product Update and Support Policy: https://access.redhat.com/support/policy/updates/jboss_notes/

Affected upstream versions: n/a
Upstream repository: https://github.com/seam2/jboss-seam
Upstream fix commit: 090aa6252affc978a96c388e3fc2c1c2688d9bb5
CVE-2013-6449: openssl: crash when using TLS 1.2 caused by use of incorrect hash algorithm
Component: openssl
Severity: Important
Public date: 2013-12-19T00:00:00+00:00

The ssl_get_algorithm2 function in ssl/s3_lib.c in OpenSSL before 1.0.2 obtains a certain version number from an incorrect data structure, which allows remote attackers to cause a denial of service (daemon crash) via crafted traffic from a TLS 1.2 client.

Statement: This issue did not affect the versions of openssl as shipped with Red Hat Enterprise Linux 5 and earlier.

Affected upstream versions: n/a
Fixed upstream versions: OpenSSL_1_0_1f
Upstream repository: https://git.openssl.org/gitweb/openssl.git
Upstream fix commit: ca989269a2876bae79393bd54c3e72d49975fc75
CVE-2013-6450: openssl: crash in DTLS renegotiation after packet loss
Component: openssl
Severity: Important
Public date: 2013-12-19T00:00:00+00:00

The DTLS retransmission implementation in OpenSSL 1.0.0 before 1.0.0l and 1.0.1 before 1.0.1f does not properly maintain data structures for digest and encryption contexts, which might allow man-in-the-middle attackers to trigger the use of a different context and cause a denial of service (application crash) by interfering with packet delivery, related to ssl/d1_both.c and ssl/t1_enc.c.

Statement: This issue did not affect the versions of openssl as shipped with Red Hat Enterprise Linux 5 and earlier.

Affected upstream versions: n/a
Fixed upstream versions: OpenSSL_1_0_1f
Upstream repository: https://git.openssl.org/gitweb/openssl.git
Upstream fix commit: 34628967f1e65dc8f34e000f0f5518e21afbfc7b
CVE-2013-6462: libXfont: stack-based buffer overflow flaw when parsing Glyph Bitmap Distribution Format (BDF) fonts
Component: libXfont
Severity: Important
CWE: CWE-121 (Stack-based Buffer Overflow)
Public date: 2014-01-07T00:00:00+00:00

Stack-based buffer overflow in the bdfReadCharacters function in bitmap/bdfread.c in X.Org libXfont 1.1 through 1.4.6 allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a long string in a character name in a BDF font file.


Affected upstream versions: n/a
Fixed upstream versions: libXfont-1.4.7
Upstream repository: https://cgit.freedesktop.org/xorg/lib/libXfont
Upstream fix commit: 4d024ac10f964f6bd372ae0dd14f02772a6e5f63
CVE-2013-6477: pidgin: DoS when handling timestamps in the XMPP plugin
Component: pidgin
Severity: Moderate
CWE: CWE-190 (Integer Overflow or Wraparound)
Public date: 2014-01-28T00:00:00+00:00

Multiple integer signedness errors in libpurple in Pidgin before 2.10.8 allow remote attackers to cause a denial of service (application crash) via a crafted timestamp value in an XMPP message.


Affected upstream versions: n/a
Upstream repository: https://hg.pidgin.im/pidgin/main
Upstream fix commit: 852014ae74a0
CVE-2013-6478: pidgin: DoS when rendering long URLs
Component: pidgin
Severity: Low
CWE: CWE-770 (Allocation of Resources Without Limits or Throttling)
Public date: 2014-01-28T00:00:00+00:00

gtkimhtml.c in Pidgin before 2.10.8 does not properly interact with underlying library support for wide Pango layouts, which allows user-assisted remote attackers to cause a denial of service (application crash) via a long URL that is examined with a tooltip.


Affected upstream versions: n/a
Upstream repository: https://hg.pidgin.im/pidgin/main
Upstream fix commit: 2bb66ef1475e
CVE-2013-6479: pidgin: DoS when parsing certain HTTP response headers
Component: pidgin
Severity: Moderate
Public date: 2014-01-28T00:00:00+00:00

util.c in libpurple in Pidgin before 2.10.8 does not properly allocate memory for HTTP responses that are inconsistent with the Content-Length header, which allows remote HTTP servers to cause a denial of service (application crash) via a crafted response.


Affected upstream versions: n/a
Upstream repository: https://hg.pidgin.im/pidgin/main
Upstream fix commit: cd529e1158d3
CVE-2013-6481: pidgin: DoS caused due to OOB read in Yahoo protocol plugin
Component: pidgin
Severity: Moderate
CWE: CWE-130 (Improper Handling of Length Parameter Inconsistency)
Public date: 2014-01-28T00:00:00+00:00

libpurple/protocols/yahoo/libymsg.c in Pidgin before 2.10.8 allows remote attackers to cause a denial of service (crash) via a Yahoo! P2P message with a crafted length field, which triggers a buffer over-read.


Affected upstream versions: n/a
Upstream repository: https://hg.pidgin.im/pidgin/main
Upstream fix commit: 4d139ce8f7ec
CVE-2013-6483: pidgin: Possible spoofing using iq replies in XMPP protocol plugin
Component: pidgin
Severity: Moderate
CWE: CWE-290 (Authentication Bypass by Spoofing)
Public date: 2014-01-28T00:00:00+00:00

The XMPP protocol plugin in libpurple in Pidgin before 2.10.8 does not properly determine whether the from address in an iq reply is consistent with the to address in an iq request, which allows remote attackers to spoof iq traffic or cause a denial of service (NULL pointer dereference and application crash) via a crafted reply.


Affected upstream versions: n/a
Upstream repository: https://hg.pidgin.im/pidgin/main
Upstream fix commit: 93d4bff19574
CVE-2013-6484: pidgin: DoS via specially-crafted stun messages
Component: pidgin
Severity: Moderate
CWE: CWE-190 (Integer Overflow or Wraparound)
Public date: 2014-01-28T00:00:00+00:00

The STUN protocol implementation in libpurple in Pidgin before 2.10.8 allows remote STUN servers to cause a denial of service (out-of-bounds write operation and application crash) by triggering a socket read error.


Affected upstream versions: n/a
Upstream repository: https://hg.pidgin.im/pidgin/main
Upstream fix commit: 932b985540e9
CVE-2013-6485: pidgin: Heap-based buffer overflow when parsing chunked HTTP responses
Component: pidgin
Severity: Moderate
CWE: CWE-190 (Integer Overflow or Wraparound)
Public date: 2014-01-28T00:00:00+00:00

Buffer overflow in util.c in libpurple in Pidgin before 2.10.8 allows remote HTTP servers to cause a denial of service (application crash) or possibly have unspecified other impact via an invalid chunk-size field in chunked transfer-coding data.


Affected upstream versions: n/a
Upstream repository: https://hg.pidgin.im/pidgin/main
Upstream fix commit: c9e5aba2dafd
CVE-2013-6487: pidgin: Heap-based buffer overflow in Gadu-Gadu protocol plugin
Component: pidgin
Severity: Moderate
CWE: CWE-122 (Heap-based Buffer Overflow)
Public date: 2014-01-28T00:00:00+00:00

Integer overflow in libpurple/protocols/gg/lib/http.c in the Gadu-Gadu (gg) parser in Pidgin before 2.10.8 allows remote attackers to have an unspecified impact via a large Content-Length value, which triggers a buffer overflow.


Affected upstream versions: n/a
Upstream repository: https://hg.pidgin.im/pidgin/main
Upstream fix commit: ec15aa187aa0
CVE-2013-6489: pidgin: Heap-based buffer overflow in MXit emoticon parsing
Component: pidgin
Severity: Moderate
CWE: CWE-190 (Integer Overflow or Wraparound)
Public date: 2014-01-28T00:00:00+00:00

Integer signedness error in the MXit functionality in Pidgin before 2.10.8 allows remote attackers to cause a denial of service (segmentation fault) via a crafted emoticon value, which triggers an integer overflow and a buffer overflow.


Affected upstream versions: n/a
Upstream repository: https://hg.pidgin.im/pidgin/main
Upstream fix commit: 4c897372b5a4
CVE-2013-6490: pidgin: Heap-based buffer overflow in SIMPLE protocol plugin
Component: pidgin
Severity: Moderate
CWE: CWE-190 (Integer Overflow or Wraparound)
Public date: 2014-01-28T00:00:00+00:00

The SIMPLE protocol functionality in Pidgin before 2.10.8 allows remote attackers to have an unspecified impact via a negative Content-Length header, which triggers a buffer overflow.


Affected upstream versions: n/a
Upstream repository: https://hg.pidgin.im/pidgin/main
Upstream fix commit: 6bd2dd10e5da
CVE-2013-6493: icedtea-web: insecure temporary file use flaw in LiveConnect implementation
Component: icedtea-web
Severity: Moderate
CWE: CWE-377 (Insecure Temporary File)
Public date: 2014-02-05T00:00:00+00:00

The LiveConnect implementation in plugin/icedteanp/IcedTeaNPPlugin.cc in IcedTea-Web before 1.4.2 allows local users to read the messages between a Java applet and a web browser by pre-creating a temporary socket file with a predictable name in /tmp.


Affected upstream versions: n/a
Upstream repository: https://icedtea.classpath.org/hg/icedtea-web
Upstream fix commit: 228e3652214a
CVE-2013-6630: libjpeg: information leak (read of uninitialized memory)
Component: libjpeg
Severity: Moderate
CWE: CWE-456 (Missing Initialization of a Variable)
Public date: 2013-11-12T00:00:00+00:00

The get_dht function in jdmarker.c in libjpeg-turbo through 1.3.0, as used in Google Chrome before 31.0.1650.48 and other products, does not set all elements of a certain Huffman value array during the reading of segments that follow Define Huffman Table (DHT) JPEG markers, which allows remote attackers to obtain sensitive information from uninitialized memory locations via a crafted JPEG image.


Affected upstream versions: n/a
Upstream repository: https://git.chromium.org/gitweb/chromium/deps/libjpeg_turbo.git
Upstream fix commit: 32cab49bd4cb1ce069a435fd75f9439c34ddc6f8
CVE-2013-6712: php: heap-based buffer over-read in DateInterval
Component: php
Severity: Low
CWE: CWE-122 (Heap-based Buffer Overflow)
Public date: 2013-11-27T00:00:00+00:00

A buffer over-read flaw was found in the way the DateInterval class parsed interval specifications. An attacker able to make a PHP application parse a specially crafted specification using DateInterval could possibly cause the PHP interpreter to crash.

Statement: This issue did not affect the php packages as shipped with Red Hat Enterprise Linux 5. This issue did not affect the php packages as shipped with Red Hat Enterprise Linux 7.

Affected upstream versions: n/a
Fixed upstream versions: php-5.4.24
Upstream repository: https://git.php.net/php-src.git
Upstream fix commit: 12fe4e90be7bfa2a763197079f68f5568a14e071
CVE-2013-6800: krb5: KDC remote DoS (NULL pointer dereference and daemon crash)
Component: krb5
Severity: Moderate
CWE: CWE-476 (NULL Pointer Dereference)
Public date: 2013-11-04T00:00:00+00:00

It was found that if a KDC served multiple realms, certain requests could cause the setup_server_realm() function to dereference a NULL pointer. A remote, unauthenticated attacker could use this flaw to crash the KDC using a specially crafted request.


Affected upstream versions: n/a
Fixed upstream versions: krb5-1.10.7-final
Upstream repository: https://github.com/krb5/krb5
Upstream fix commit: c2ccf4197f697c4ff143b8a786acdd875e70a89d
CVE-2013-7263: Kernel: net: leakage of uninitialized memory to user-space via recv syscalls
Component: Kernel
Severity: Low
Public date: 2013-11-18T00:00:00+00:00

The Linux kernel before 3.12.4 updates certain length values before ensuring that associated data structures have been initialized, which allows local users to obtain sensitive information from kernel stack memory via a (1) recvfrom, (2) recvmmsg, or (3) recvmsg system call, related to net/ipv4/ping.c, net/ipv4/raw.c, net/ipv4/udp.c, net/ipv6/raw.c, and net/ipv6/udp.c.


Affected upstream versions: n/a
Fixed upstream versions: v3.13
Upstream repository: https://github.com/torvalds/linux
Upstream fix commit: bceaa90240b6019ed73b49965eac7d167610be69
CVE-2013-7265: Kernel: net: leakage of uninitialized memory to user-space via recv syscalls
Component: Kernel
Severity: Low
Public date: 2013-11-18T00:00:00+00:00

The pn_recvmsg function in net/phonet/datagram.c in the Linux kernel before 3.12.4 updates a certain length value before ensuring that an associated data structure has been initialized, which allows local users to obtain sensitive information from kernel stack memory via a (1) recvfrom, (2) recvmmsg, or (3) recvmsg system call.

Statement: This issue does not affect the version of the kernel package as shipped with
Red Hat Enterprise Linux 5.

Affected upstream versions: n/a
Fixed upstream versions: v3.13
Upstream repository: https://github.com/torvalds/linux
Upstream fix commit: bceaa90240b6019ed73b49965eac7d167610be69
CVE-2013-7266: Kernel: net: information leak in recvmsg handler msg_name & msg_namelen logic
Component: Kernel
Severity: Low
Public date: 2013-11-21T00:00:00+00:00

The mISDN_sock_recvmsg function in drivers/isdn/mISDN/socket.c in the Linux kernel before 3.12.4 does not ensure that a certain length value is consistent with the size of an associated data structure, which allows local users to obtain sensitive information from kernel memory via a (1) recvfrom, (2) recvmmsg, or (3) recvmsg system call.

Statement: This issue does not affect the versions of the kernel package as shipped with
Red Hat Enterprise Linux 5 and Red Hat Enterprise MRG 2.

Affected upstream versions: n/a
Fixed upstream versions: v3.13
Upstream repository: https://git.kernel.org/linux/kernel/git/torvalds/linux-2.6.git
Upstream fix commit: f3d3342602f8bcbf37d7c46641cb9bca7618eb1c
CVE-2013-7270: Kernel: net: information leak in recvmsg handler msg_name & msg_namelen logic
Component: Kernel
Severity: Low
Public date: 2013-11-21T00:00:00+00:00

The packet_recvmsg function in net/packet/af_packet.c in the Linux kernel before 3.12.4 updates a certain length value before ensuring that an associated data structure has been initialized, which allows local users to obtain sensitive information from kernel memory via a (1) recvfrom, (2) recvmmsg, or (3) recvmsg system call.

Statement: This issue affects the versions of the Linux kernel as shipped with Red Hat Enterprise Linux 5.

Red Hat Enterprise Linux 5 is now in Production 3 Phase of the support and
maintenance life cycle. This has been rated as having Low security
impact and is not currently planned to be addressed in future updates. For
additional information, refer to the Red Hat Enterprise Linux Life
Cycle: https://access.redhat.com/support/policy/updates/errata/.

Affected upstream versions: n/a
Fixed upstream versions: v3.13
Upstream repository: https://git.kernel.org/linux/kernel/git/torvalds/linux-2.6.git
Upstream fix commit: f3d3342602f8bcbf37d7c46641cb9bca7618eb1c
CVE-2013-7330: jenkins: configure a project you do not have access to (SECURITY-55)
Component: jenkins
Severity: Moderate
CWE: CWE-863 (Incorrect Authorization)
Public date: 2014-02-11T00:00:00+00:00

Jenkins before 1.502 allows remote authenticated users to configure an otherwise restricted project via vectors related to post-build actions.


Affected upstream versions: n/a
Fixed upstream versions: jenkins-1.502
Upstream repository: https://github.com/jenkinsci/jenkins
Upstream fix commit: 36342d71e29e0620f803a7470ce96c61761648d8
CVE-2013-7336: libvirt: unprivileged user can crash libvirtd during spice migration
Component: libvirt
Severity: Moderate
Public date: 2013-09-19T00:00:00+00:00

The qemuMigrationWaitForSpice function in qemu/qemu_migration.c in libvirt before 1.1.3 does not properly enter a monitor when performing seamless SPICE migration, which allows local users to cause a denial of service (NULL pointer dereference and libvirtd crash) by causing domblkstat to be called at the same time as the qemuMonitorGetSpiceMigrationStatus function.

Statement: Not vulnerable.

This issue did not affect the versions of libvirt package as shipped with Red Hat Enterprise Linux 5 and 6 (since http://rhn.redhat.com/errata/RHBA-2013-1581.html, Red Hat Enterprise Linux 6.5 GA).

Affected upstream versions: n/a
Fixed upstream versions: v1.1.3
Upstream repository: https://libvirt.org/git/libvirt.git
Upstream fix commit: 484cc321
CVE-2013-7339: kernel: net: rds: dereference of a NULL device in rds_ib_laddr_check()
Component: kernel
Severity: Moderate
Public date: 2013-12-19T00:00:00+00:00

A NULL pointer dereference flaw was found in the rds_ib_laddr_check() function in the Linux kernel's implementation of Reliable Datagram Sockets (RDS). A local, unprivileged user could use this flaw to crash the system.


Affected upstream versions: n/a
Fixed upstream versions: v3.13
Upstream repository: https://github.com/torvalds/linux
Upstream fix commit: c2349758acf1874e4c2b93fe41d072336f1a31d0
CVE-2013-7345: file: extensive backtracking in awk rule regular expression
Component: file
Severity: Moderate
CWE: CWE-407 (Inefficient Algorithmic Complexity)
Public date: 2011-12-31T00:00:00+00:00

A denial of service flaw was found in the File Information (fileinfo) extension rules for detecting AWK files. A remote attacker could use this flaw to cause a PHP application using fileinfo to consume an excessive amount of CPU.

Statement: This issue did not affect the versions of file as shipped with Red Hat Enterprise Linux 5, 6, and 7, the versions of php as shipped with Red Hat Enterprise Linux 5 and 6, and the versions of php53 as shipped with Red Hat Enterprise Linux 5.

Affected upstream versions: n/a
Fixed upstream versions: FILE5_15
Upstream repository: https://github.com/file/file
Upstream fix commit: ef2329cf71acb59204dd981e2c6cce6c81fe467c
CVE-2013-7421: kernel: crypto api unprivileged arbitrary module load via request_module()
Component: kernel
Severity: Low
CWE: CWE-749 (Exposed Dangerous Method or Function)
Public date: 2013-03-04T00:00:00+00:00

A flaw was found in the way the Linux kernel's Crypto subsystem handled automatic loading of kernel modules. A local user could use this flaw to load any installed kernel module, and thus increase the attack surface of the running kernel.

Statement: This issue did not affect the versions of the kernel as shipped
with Red Hat Enterprise Linux 4, 5, and 6.

This issue affects the versions of the Linux as shipped with Red Hat Enterprise Linux 7. Red Hat Product Security has rated this issue as having Low  security impact. A future update may address this issue. For additional information, refer to the Issue Severity Classification: https://access.redhat.com/security/updates/classification/.

Affected upstream versions: n/a
Fixed upstream versions: v3.19
Upstream repository: https://github.com/torvalds/linux
Upstream fix commit: 5d26a105b5a73e5635eae0629b42fa0a90e07b7b
CVE-2013-7424: glibc: Invalid-free when using getaddrinfo()
Component: glibc
Severity: Moderate
Public date: 2015-01-27T00:00:00+00:00

An invalid free flaw was found in glibc's getaddrinfo() function when used with the AI_IDN flag. A remote attacker able to make an application call this function could use this flaw to execute arbitrary code with the permissions of the user running the application. Note that this flaw only affected applications using glibc compiled with libidn support.


Affected upstream versions: n/a
Fixed upstream versions: glibc-2.15
Upstream repository: https://sourceware.org/git/glibc.git
Upstream fix commit: 2e96f1c7
CVE-2013-7436: novnc: session hijack through insecurely set session token cookies
Component: novnc
Severity: Moderate
CWE: CWE-319 (Cleartext Transmission of Sensitive Information)
Public date: 2013-10-28T00:00:00+00:00

It was discovered that noVNC did not properly set the 'secure' flag when issuing cookies. An attacker could use this flaw to intercept cookies via a man-in-the-middle attack.


Affected upstream versions: n/a
Fixed upstream versions: v0.5
Upstream repository: https://github.com/kanaka/noVNC
Upstream fix commit: ad941faddead705cd611921730054767a0b32dcd
CVE-2013-7440: python: wildcard matching rules do not follow RFC 6125
Component: python
Severity: Low
Public date: 2013-08-12T00:00:00+00:00

Multiple flaws were found in the way Python's SSL module performed matching of certificate names containing wildcards. A remote attacker able to obtain a valid certificate that contained certain names with wildcards could have them incorrectly accepted by Python SSL clients, not following the RFC 6125 recommendations.

Statement: This issue affects the versions of python27-python-pip, python-pymongo and python-virtualenv as shipped with Red Hat OpenShift 2.x and Satellite 6. Red Hat Product Security has rated this issue as having Low security impact. A future update may address this issue. For additional information, refer to the Issue Severity Classification: https://access.redhat.com/security/updates/classification/.

Affected upstream versions: n/a
Upstream repository: https://hg.python.org/cpython
Upstream fix commit: 10d0edadbcdd
CVE-2013-7456: gd: incorrect boundary adjustment in _gdContributionsCalc
Component: gd
Severity: Low
CWE: CWE-125 (Out-of-bounds Read)
Public date: 2013-09-24T00:00:00+00:00

gd_interpolation.c in the GD Graphics Library (aka libgd) before 2.1.1, as used in PHP before 5.5.36, 5.6.x before 5.6.22, and 7.x before 7.0.7, allows remote attackers to cause a denial of service (out-of-bounds read) or possibly have unspecified other impact via a crafted image that is mishandled by the imagescale function.


Affected upstream versions: n/a
Fixed upstream versions: php-5.5.36
Upstream repository: https://github.com/php/php-src
Upstream fix commit: 7a1aac3343af85b4af4df5f8844946eaa27394ab
CVE-2014-0020: pidgin: DoS in IRC protocol plugin due to arguement parsing
Component: pidgin
Severity: Moderate
CWE: CWE-628 (Function Call with Incorrectly Specified Arguments)
Public date: 2014-01-28T00:00:00+00:00

The IRC protocol plugin in libpurple in Pidgin before 2.10.8 does not validate argument counts, which allows remote IRC servers to cause a denial of service (application crash) via a crafted message.


Affected upstream versions: n/a
Upstream repository: https://hg.pidgin.im/pidgin/main
Upstream fix commit: a167504359e5