markup.c in the MXit protocol plugin in libpurple in Pidgin before 2.10.10 allows remote servers to cause a denial of service (application crash) via a large length value in an emoticon response.
{ "availability": "No subscription required", "ubuntu_priority": "medium", "binaries": [ { "binary_name": "finch", "binary_version": "1:2.10.9-0ubuntu3.2" }, { "binary_name": "finch-dev", "binary_version": "1:2.10.9-0ubuntu3.2" }, { "binary_name": "libpurple-bin", "binary_version": "1:2.10.9-0ubuntu3.2" }, { "binary_name": "libpurple-dev", "binary_version": "1:2.10.9-0ubuntu3.2" }, { "binary_name": "libpurple0", "binary_version": "1:2.10.9-0ubuntu3.2" }, { "binary_name": "pidgin", "binary_version": "1:2.10.9-0ubuntu3.2" }, { "binary_name": "pidgin-data", "binary_version": "1:2.10.9-0ubuntu3.2" }, { "binary_name": "pidgin-dbg", "binary_version": "1:2.10.9-0ubuntu3.2" }, { "binary_name": "pidgin-dev", "binary_version": "1:2.10.9-0ubuntu3.2" } ] }