Vulnerability Database

289,697

Total vulnerabilities in the database

CVE-2014-3694

The (1) bundled GnuTLS SSL/TLS plugin and the (2) bundled OpenSSL SSL/TLS plugin in libpurple in Pidgin before 2.10.10 do not properly consider the Basic Constraints extension during verification of X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.

  • Published: Oct 29, 2014
  • Updated: Apr 13, 2023
  • CVE: CVE-2014-3694
  • Severity: Medium
  • Exploit:

CVSS v2:

  • Severity: Medium
  • Score: 6.4
  • AV:N/AC:L/Au:N/C:P/I:P/A:N

CWEs:

Software From Fixed in
opensuse / opensuse 12.3 12.3.x
opensuse / opensuse 13.1 13.1.x
opensuse / opensuse 13.2 13.2.x
canonical / ubuntu_linux 12.04 12.04.x
canonical / ubuntu_linux 14.10 14.10.x
canonical / ubuntu_linux 14.04 14.04.x
debian / debian_linux 7.0 7.0.x
pidgin / pidgin - 2.10.9.x
pidgin / pidgin 2.10.1 2.10.1.x
pidgin / pidgin 2.10.8 2.10.8.x
pidgin / pidgin 2.10.7 2.10.7.x
pidgin / pidgin 2.10.2 2.10.2.x
pidgin / pidgin 2.10.5 2.10.5.x
pidgin / pidgin 2.10.4 2.10.4.x
pidgin / pidgin 2.10.0 2.10.0.x
pidgin / pidgin 2.10.6 2.10.6.x
pidgin / pidgin 2.10.3 2.10.3.x