Pidgin Denial-of-Service Vulnerability

A denial-of-service vulnerability has been identified in Pidgin version 2.13.0. This issue allows local attackers to crash the application by entering an excessively long username during account creation. The vulnerability arises when the application processes a buffer of 1000 characters in the username field. Once the account is created, joining a chat triggers a crash, rendering the application unavailable.

Impact

Exploiting this vulnerability causes Pidgin to crash, disrupting any active chat sessions and requiring the application to be restarted.

Reproduction

To reproduce this vulnerability, create a new account in Pidgin 2.13.0. Enter 1000 characters in the username field and any text in the password field. After adding the account, attempt to join a chat. The application will crash, indicating a successful exploitation of the denial-of-service vulnerability.