How to Report a Security Vulnerability

If you think you've found a bug in Pidgin, Finch or libpurple that could potentially be exploited in a way that could harm users or prevent them from using the program (e.g. a remotely triggerable crash), please do not disclose the information publicly! Please do not tell people on the Pidgin devel mailing list, in the Pidgin IRC channel, or in the Pidgin Jabber conference room.

Instead, send an email to security@…. Emails to this alias are sent to a core group of developers who will review the problem and take appropriate action.

Process

1a. If the bug is reported to the security@… mailing list, reply to the reporter with an email based on this template:

Thank you for reporting this problem to us! We will investigate it and make an appropriate fix. In the mean time, we ask that you please not disclose the problem to the public, yet! Please provide us with the following information: TODO

1b. If the bug has already been announced publicly (on devel mailing list, IRC, or Jabber conference), send all information about the bug to security@…

2. The developers on the security email alias should determine an appropriate fix and create a patch.
3. Once an agreed upon patch has been created, an email based on this template should be sent to the packagers mailing list: Subject: Security Vulnerability Body: A security vulnerability has been discovered in [Pidgin|Finch|libpurple|other] Affected software: [e.x. "Pidgin 2.4.2-2.6.0", or "All clients based on libpurple 2.3.3-2.3.7"] Discovered by: [Name of company or individual] Public: [yes or no] Embargo date: [Either "none" or the agreed upon date]

4. Announce to the world, create new packages, update security page