# HG changeset patch
# Node ID 7e3a62df856e
# Parent  b4241824a900
diff --git a/hugo/content/about/security/advisories/cve-2014-0020-00.md b/hugo/content/about/security/advisories/cve-2014-0020-00.md
new file mode 100644
--- /dev/null
+++ b/hugo/content/about/security/advisories/cve-2014-0020-00.md
@@ -0,0 +1,22 @@
+---
+title: cve-2014-0020-00
+date: 2014-01-28T00:00:00.000Z
+cveNumber: cve-2014-0020
+summary: Remotely triggerable crash in IRC argument parsing
+discoveredBy: Daniel Atallah
+fixedInRelease: 2.10.8
+type: security
+layout: cve
+hidden: true
+---
+
+### Description
+
+A malicious server or man-in-the-middle could trigger a crash in libpurple by
+sending a message with fewer than expected arguments.
+
+### Mitigation
+
+Verify that incoming messages contain the appropriate number of arguments before
+handling them.
+
diff --git a/hugo/content/about/security/advisories/cve-2014-3694-00.md b/hugo/content/about/security/advisories/cve-2014-3694-00.md
new file mode 100644
--- /dev/null
+++ b/hugo/content/about/security/advisories/cve-2014-3694-00.md
@@ -0,0 +1,26 @@
+---
+title: cve-2014-3694-00
+date: 2014-10-22T00:00:00.000Z
+cveNumber: cve-2014-3694
+summary: Insufficient SSL certificate validation
+discoveredBy: |
+  An anonymous person and Jacob Appelbaum of the Tor Project, with thanks to
+  Moxie Marlinspike for first publishing about this type of vulnerability
+fixedInRelease: 2.10.10
+type: security
+layout: cve
+hidden: true
+---
+
+### Description
+
+Both of libpurple's bundled SSL/TLS plugins (one for GnuTLS and one for NSS)
+failed to check that the Basic Constraints extension allowed intermediate
+certificates to act as CAs. This allowed anyone with any valid certificate to
+create a fake certificate for any arbitrary domain and Pidgin would trust it.
+
+### Mitigation
+
+Both bundled plugins were changed to check the Basic Constraints extension on
+all intermediate CA certificates.
+
diff --git a/hugo/content/about/security/advisories/cve-2014-3695-00.md b/hugo/content/about/security/advisories/cve-2014-3695-00.md
new file mode 100644
--- /dev/null
+++ b/hugo/content/about/security/advisories/cve-2014-3695-00.md
@@ -0,0 +1,22 @@
+---
+title: cve-2014-3695-00
+date: 2014-10-22T00:00:00.000Z
+cveNumber: cve-2014-3695
+summary: Remote crash parsing malformed MXit emoticon
+discoveredBy: Yves Younan and Richard Johnson of Cisco Talos
+fixedInRelease: 2.10.10
+type: security
+layout: cve
+hidden: true
+---
+
+### Description
+
+A malicious server or man-in-the-middle could trigger a crash in libpurple by
+sending an emoticon with an overly large length value.
+
+### Mitigation
+
+Verify that the length value is valid before attempting to read data from the
+buffer.
+
diff --git a/hugo/content/about/security/advisories/cve-2014-3696-00.md b/hugo/content/about/security/advisories/cve-2014-3696-00.md
new file mode 100644
--- /dev/null
+++ b/hugo/content/about/security/advisories/cve-2014-3696-00.md
@@ -0,0 +1,22 @@
+---
+title: cve-2014-3696-00
+date: 2014-10-22T00:00:00.000Z
+cveNumber: cve-2014-3696
+summary: Remote crash parsing malformed Groupwise message
+discoveredBy: Yves Younan and Richard Johnson of Cisco Talos
+fixedInRelease: 2.10.10
+type: security
+layout: cve
+hidden: true
+---
+
+### Description
+
+A malicious server or man-in-the-middle could trigger a crash in libpurple by
+specifying that a large amount of memory should be allocated in many places in
+the UI.
+
+### Mitigation
+
+Impose a maximum length when reading various types of messages.
+
diff --git a/hugo/content/about/security/advisories/cve-2014-3697-00.md b/hugo/content/about/security/advisories/cve-2014-3697-00.md
new file mode 100644
--- /dev/null
+++ b/hugo/content/about/security/advisories/cve-2014-3697-00.md
@@ -0,0 +1,22 @@
+---
+title: cve-2014-3697-00
+date: 2014-10-22T00:00:00.000Z
+cveNumber: cve-2014-3697
+summary: Malicious smiley themes could alter arbitrary files
+discoveredBy: Yves Younan of Cisco Talos
+fixedInRelease: 2.10.10
+type: security
+layout: cve
+hidden: true
+---
+
+### Description
+
+A bug in the untar code on Windows could allow a malicious smiley theme to place
+a file anywhere on the file system, or alter an existing file when installing a
+smiley theme via drag and drop on Windows.
+
+### Mitigation
+
+Fix the untar code to ensure all paths are relative.
+
diff --git a/hugo/content/about/security/advisories/cve-2014-3698-00.md b/hugo/content/about/security/advisories/cve-2014-3698-00.md
new file mode 100644
--- /dev/null
+++ b/hugo/content/about/security/advisories/cve-2014-3698-00.md
@@ -0,0 +1,23 @@
+---
+title: cve-2014-3698-00
+date: 2014-10-22T00:00:00.000Z
+cveNumber: cve-2014-3698
+summary: Potential information leak from XMPP
+discoveredBy: Thijs Alkemade and Paul Aurich
+fixedInRelease: 2.10.10
+type: security
+layout: cve
+hidden: true
+---
+
+### Description
+
+A malicious server and possibly even a malicious remote user could create a
+carefully crafted XMPP message that causes libpurple to send an XMPP message
+containing arbitrary memory.
+
+### Mitigation
+
+Correctly determine the start and end position of buffers when performing
+stringprep.
+
