IMFreedom Security

This page lists all potential security vulnerabilities discovered since August 1st, 2004. Unfortunately we did not start collecting data before this date. If you are interested in pulling this missing information out of the CVE database, please don’t hesitate to send up a pull request!

2022 #

MITM when used without DNSSEC
CVE-2022-26491
dnssec

2017 #

Out-of-bounds write when stripping xml
CVE-2017-2640

2016 #

X.509 Certificates Improperly Imported
CVE-2016-1000030
Pidgin MXIT Table Command Denial of Service Vulnerability
CVE-2016-2366, TALOS-2016-0134
mxitprotocol
Pidgin MXIT Suggested Contacts Memory Disclosure Vulnerability
CVE-2016-2375, TALOS-2016-0143
mxitprotocol
Pidgin MXIT Splash Image Arbitrary File Overwrite Vulnerability
CVE-2016-4323, TALOS-2016-0128
mxitprotocol
Pidgin MXIT read stage 0x3 Code Execution Vulnerability
CVE-2016-2376, TALOS-2016-0118
mxitprotocol
Pidgin MXIT mxit_convert_markup_tx Information Leak Vulnerability
CVE-2016-2380, TALOS-2016-0123
mxitprotocol
Pidgin MXIT MultiMX Message Code Execution Vulnerability
CVE-2016-2374, TALOS-2016-0142
mxitprotocol
Pidgin MXIT Markup Command Denial of Service Vulnerability
CVE-2016-2365, TALOS-2016-0133
mxitprotocol
Pidgin MXIT HTTP Content-Length Buffer Overflow Vulnerability
CVE-2016-2377, TALOS-2016-0119
mxitprotocol
Pidgin MXIT get_utf8_string Code Execution Vulnerability
CVE-2016-2378, TALOS-2016-0120
mxitprotocol
Pidgin MXIT g_snprintf Multiple Buffer Overflow Vulnerabilities
CVE-2016-2368, TALOS-2016-0136
mxitprotocol
Pidgin MXIT File Transfer Length Memory Disclosure Vulnerability
CVE-2016-2372, TALOS-2016-0140
mxitprotocol
Pidgin MXIT Extended Profiles Code Execution Vulnerability
CVE-2016-2371, TALOS-2016-0139
mxitprotocol
Pidgin MXIT Custom Resource Denial of Service Vulnerability
CVE-2016-2370, TALOS-2016-0138
mxitprotocol
Pidgin MXIT CP_SOCK_REC_TERM Denial of Service Vulnerability
CVE-2016-2369, TALOS-2016-0137
mxitprotocol
Pidgin MXIT Contact Mood Denial of Service Vulnerability
CVE-2016-2373, TALOS-2016-0141
mxitprotocol
Pidgin MXIT Avatar Length Memory Disclosure Vulnerability
CVE-2016-2367, TALOS-2016-0135
mxitprotocol

2014 #

Remote crash parsing malformed MXit emoticon
CVE-2014-3695
mxitprotocol
Remote crash parsing malformed Groupwise message
CVE-2014-3696
groupwisenovellprotocol
Potential information leak from XMPP
CVE-2014-3698
xmppprotocol
Malicious smiley themes could alter arbitrary files
CVE-2014-3697
Insufficient SSL certificate validation
CVE-2014-3694
XMPP doesn't verify 'from' on some iq replies
CVE-2013-6483
xmppprotocol
Remotely triggerable crash in IRC argument parsing
CVE-2014-0020
ircprotocol
Remote crash reading Yahoo! P2P message
CVE-2013-6481
yahooprotocol
Remote crash parsing HTTP responses
CVE-2013-6479
Pidgin uses clickable links to untrusted executables
CVE-2013-6486
NULL pointer dereference parsing SOAP data in MSN
CVE-2013-6482
msnprotocol
NULL pointer dereference parsing OIM data in MSN
CVE-2013-6482
msnprotocol
NULL pointer dereference parsing headers in MSN
CVE-2013-6482
msnprotocol
Crash when hovering pointer over a long URL
CVE-2013-6478
Crash reading response from STUN server
CVE-2013-6484
stun
Crash handling bad XMPP timestamp
CVE-2013-6477
xmppprotocol
Buffer overflow parsing chunked HTTP responses
CVE-2013-6485
http
Buffer overflow in MXit emoticon parsing
CVE-2013-6489
mxitprotocol
Buffer overflow in Gadu-Gadu HTTP parsing
CVE-2013-6487
gadu-gaduprotocol

2012 #

Yahoo! remote crash from incorrect character encoding
CVE-2012-6152
yahooprotocol

2011 #

XMPP remote crash
CVE-2011-4602
xmppprotocol
AIM and ICQ remote crash
CVE-2011-4601
aimicqoscarprotocol
SILC remote crash
CVE-2011-4603
silcprotocol
SILC remote crash
CVE-2011-3594
silcprotocol
Remote crash in MSN protocol plugin
CVE-2011-3184
msnprotocol
Remote crash in IRC protocol plugin
CVE-2011-2943
ircprotocol
Pidgin uses clickable links to untrusted executables
CVE-2011-3185
XMPP remote crash
CVE-2011-4939
xmppprotocol
Remote denial of service from corrupt buddy icons
CVE-2011-2485
Remote denial of service in Yahoo protocol plugin
CVE-2011-1091
yahooprotocol
Cipher API information disclosure

2010 #

MSN direct connection denial of service
CVE-2010-4528
msnprotocol
Multiple remotely-triggered denials of service
CVE-2010-3711
yahoomsnmyspaceimxmppntlmprotocol
ICQ X-Status denial of service
CVE-2010-2528
icqprotocol
MSN emoticon denial of service
CVE-2010-1624
msnprotocol
Smiley denial of service
CVE-2010-0423
MSN malformed SLP message crash
CVE-2010-0277
msnprotocol
Finch XMPP MUC crash
CVE-2010-0420
finchlibpurplexmpp
MSN file download vulnerability
CVE-2010-0013
msnprotocol

2009 #

ICQ and maybe AIM remote crash
CVE-2009-3615
aimicqoscarprotocol
XMPP may not enforce TLS
CVE-2009-3026
xmppprotocol
XMPP custom smiley parsing bug
CVE-2009-3085
xmppprotocol
MSN partial SLP invite crash
CVE-2009-3083
msnprotocol
MSN handwritten message crash
CVE-2009-3084
msnprotocol
IRC crash from malicious server
CVE-2009-2703
ircprotocol
Yahoo IM parsing crash
CVE-2009-3025
yahooprotocol
MSN overflow parsing SLP messages
CVE-2009-2694
msnprotocol
ICQ parser excessive memory allocation
CVE-2009-1889
icqprotocol
QQ remote DoS
CVE-2009-1374
qqprotocol
XMPP file transfer buffer overflow
CVE-2009-1373
xmppprotocol
MSN malformed SLP message overflow
CVE-2009-1376
msnprotocol
Remote DoS in multiple protocols
CVE-2009-1375
xmppsametimeprotocol

2008 #

NSS TLS/SSL Certificates not validated
CVE-2008-3532
nss
MSN malformed SLP message overflow
CVE-2008-2927
msnprotocol
MSN Remote file transfer filename DoS
CVE-2008-2955
msnprotocol
Remote UPnP discovery DoS
CVE-2008-2957
upnp

2007 #

NULL pointer dereference in parsing invalid HTML
CVE-2007-4999
MSN Remote "Nudge" DoS
CVE-2007-4996
msnprotocol

2005 #

Gadu-Gadu memory alignment bug
CVE-2005-2370
gadu-gaduprotocol
AIM/ICQ non-UTF-8 filename crash
CVE-2004-0500
aimicqoscarprotocol
AIM/ICQ away message buffer overflow
CVE-2005-2103
aimicqoscarprotocol
Remote Yahoo! crash
cve-2005-1269
yahooprotocol
MSN Remote DoS
CVE-2005-1934
msnprotocol
Remote crash on some protocols
CVE-2005-1261
jabberxmppsilcprotocol
MSN Remote DoS
CVE-2005-1262
msnprotocol
Jabber remote crash
CVE-2005-0967
jabberxmppprotocol
Remote DoS on receiving malformed HTML
CVE-2005-0965
Remote DoS on receiving certain messages over IRC
CVE-2005-0966
ircprotocol
Remote DoS on receiving malformed HTML
CVE-2005-0208
Remote DoS on receiving malformed HTML
CVE-2004-0473
AIM/ICQ remote denial of service
CVE-2005-0472
aimicqoscarprotocol

2004 #

MSN SLP DOS (malloc error)
msnprotocol
MSN SLP buffer overflow
CVE-2004-0891
protocolmsn
MSN File transfer DOS (malloc error)
msnprotocol
URL decode buffer overflow
CVE-2004-0785
RTF message buffer overflow
CVE-2004-0785
Local hostname resolution buffer overflow
CVE-2004-0785
protocolzephyr
Groupware message receive integer overflow
CVE-2004-0754
protocolnovell
Content-length DOS (malloc error)
Smiley theme installation lack of escaping
CVE-2004-0784
gaim
MSN strncpy buffer overflow
CVE-2004-0500
msnprotocol