The (1) bundled GnuTLS SSL/TLS plugin and the (2) bundled OpenSSL SSL/TLS plugin in libpurple in Pidgin before 2.10.10 do not properly consider the Basic Constraints extension during verification of X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.

Affected: Ubuntu:14.04:LTS: pidgin

Jacob Appelbaum and an anonymous person discovered that Pidgin incorrectly handled certificate validation. A remote attacker could exploit this to perform a machine-in-the-middle attack to view sensitive information or alter encrypted communications. (CVE-2014-3694)

Yves Younan and Richard Johnson discovered that Pidgin incorrectly handled certain malformed MXit emoticons. A malicious remote server or a machine-in-the-middle could use this issue to cause Pidgin to crash, resulting in a denial of service. (CVE-2014-3695)

Yves Younan and Richard Johnson discovered that Pidgin incorrectly handled certain malformed Groupwise messages. A malicious remote server or a machine-in-the-middle could use this issue to cause Pidgin to crash, resulting in a denial of service. (CVE-2014-3696)

Thijs Alkemade and Paul Aurich discovered that Pidgin incorrectly handled memory when processing XMPP messages. A malicious remote server or user could use this issue to cause Pidgin to disclosure arbitrary memory, resulting in an information leak. (CVE-2014-3698)