CVE-2014-3694

The (1) bundled GnuTLS SSL/TLS plugin and the (2) bundled OpenSSL SSL/TLS plugin in libpurple in Pidgin before 2.10.10 do not properly consider the Basic Constraints extension during verification of X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.

• CWE-310

• http://hg.pidgin.im/pidgin/main/rev/2e4475087f04Issue Tracking
• http://lists.opensuse.org/opensuse-updates/2014-11/msg00023.htmlThird Party Advisory
• http://lists.opensuse.org/opensuse-updates/2014-11/msg00037.htmlThird Party Advisory
• http://pidgin.im/news/security/?id=86Patch, Vendor Advisory
• http://secunia.com/advisories/60741
• http://secunia.com/advisories/61968
• http://www.debian.org/security/2014/dsa-3055Third Party Advisory
• http://www.ubuntu.com/usn/USN-2390-1Third Party Advisory
• https://access.redhat.com/errata/RHSA-2017:1854
• http://hg.pidgin.im/pidgin/main/rev/2e4475087f04Issue Tracking
• http://lists.opensuse.org/opensuse-updates/2014-11/msg00023.htmlThird Party Advisory
• http://lists.opensuse.org/opensuse-updates/2014-11/msg00037.htmlThird Party Advisory
• http://pidgin.im/news/security/?id=86Patch, Vendor Advisory
• http://secunia.com/advisories/60741
• http://secunia.com/advisories/61968
• http://www.debian.org/security/2014/dsa-3055Third Party Advisory
• http://www.ubuntu.com/usn/USN-2390-1Third Party Advisory
• https://access.redhat.com/errata/RHSA-2017:1854

Published

Oct 29, 2014

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2014-3688The SCTP implementation in the Linux kernel before 3.17.4 al…
• CVE-2014-3689The vmware-vga driver (hw/display/vmware_vga.c) in QEMU allo…
• CVE-2014-3690arch/x86/kvm/vmx.c in the KVM subsystem in the Linux kernel …5.5
• CVE-2014-3691Smart Proxy (aka Smart-Proxy and foreman-proxy) in Foreman b…
• CVE-2014-3692The customization template in Red Hat CloudForms 3.1 Managem…
• CVE-2014-3693Use-after-free vulnerability in the socket manager of Impres…
• CVE-2014-3695markup.c in the MXit protocol plugin in libpurple in Pidgin …
• CVE-2014-3696nmevent.c in the Novell GroupWise protocol plugin in libpurp…
• CVE-2014-3697Absolute path traversal vulnerability in the untar_block fun…
• CVE-2014-3698The jabber_idn_validate function in jutil.c in the Jabber pr…
• CVE-2014-3699eDeploy has RCE via cPickle deserialization of untrusted dat…9.8
• CVE-2014-3700eDeploy through at least 2014-10-14 has remote code executio…9.8