================================================== ===================
Red Hat Security Advisory
Synopsis: Moderate: pidgin security update
Advisory ID: RHSA-2009:1535-01
Product: Red Hat Enterprise Linux
Advisory URL: https://rhn.redhat.com/errata/RHSA-2009-1535.html
Issue date: 2009-10-29
CVE Names: CVE-2009-2703 CVE-2009-3083 CVE-2009-3615
================================================== ===================
1. Summary:
An updated pidgin package that fixes several security issues is now
available for Red Hat Enterprise Linux 3.
This update has been rated as having moderate security impact by the Red
Hat Security Response Team.
2. Relevant releases/architectures:
Red Hat Desktop version 3 - i386, x86_64
Red Hat Enterprise Linux AS version 3 - i386, ia64, ppc, s390, s390x, x86_64
Red Hat Enterprise Linux ES version 3 - i386, ia64, x86_64
Red Hat Enterprise Linux WS version 3 - i386, ia64, x86_64
3. Description:
Pidgin is an instant messaging program which can log in to multiple
accounts on multiple instant messaging networks simultaneously.
An invalid pointer dereference bug was found in the way the Pidgin OSCAR
protocol implementation processed lists of contacts. A remote attacker
could send a specially-crafted contact list to a user running Pidgin,
causing Pidgin to crash. (CVE-2009-3615)
A NULL pointer dereference flaw was found in the way the Pidgin IRC
protocol plug-in handles IRC topics. A malicious IRC server could send a
specially-crafted IRC TOPIC message, which once received by Pidgin, would
lead to a denial of service (Pidgin crash). (CVE-2009-2703)
A NULL pointer dereference flaw was found in the way the Pidgin MSN
protocol plug-in handles improper MSNSLP invitations. A remote attacker
could send a specially-crafted MSNSLP invitation request, which once
accepted by a valid Pidgin user, would lead to a denial of service (Pidgin
crash). (CVE-2009-3083)
All Pidgin users should upgrade to this updated package, which contains
backported patches to resolve these issues. Pidgin must be restarted for
this update to take effect.
4. Solution:
Before applying this update, make sure that all previously-released
errata relevant to your system have been applied.
This update is available via Red Hat Network. Details on how to use
the Red Hat Network to apply this update are available at
http://kbase.redhat.com/faq/docs/DOC-11259
5. Bugs fixed (http://bugzilla.redhat.com/):
521823 - CVE-2009-2703 Pidgin: NULL pointer dereference by handling IRC topic(s) (DoS)
521832 - CVE-2009-3083 Pidgin: NULL pointer dereference by processing incomplete MSN SLP invite (DoS)
529357 - CVE-2009-3615 Pidgin: Invalid pointer dereference (crash) after receiving contacts from SIM IM client
These packages are GPG signed by Red Hat for security. Our key and
details on how to verify the signature are available from
https://www.redhat.com/security/team/key/#package
--
Enterprise-watch-list mailing list
Enterprise-watch-list@redhat.com
https://www.redhat.com/mailman/listinfo/enterprise-watch-list
10-29-2009, 01:41 PM
Moderate: pidgin security update
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
================================================== ===================
Red Hat Security Advisory
Synopsis: Moderate: pidgin security update
Advisory ID: RHSA-2009:1536-01
Product: Red Hat Enterprise Linux
Advisory URL: https://rhn.redhat.com/errata/RHSA-2009-1536.html
Issue date: 2009-10-29
CVE Names: CVE-2009-3615
================================================== ===================
1. Summary:
Updated pidgin packages that fix a security issue are now available for Red
Hat Enterprise Linux 4 and 5.
This update has been rated as having moderate security impact by the Red
Hat Security Response Team.
2. Relevant releases/architectures:
RHEL Desktop Workstation (v. 5 client) - i386, x86_64
RHEL Optional Productivity Applications (v. 5 server) - i386, x86_64
Red Hat Enterprise Linux AS version 4 - i386, ia64, ppc, x86_64
Red Hat Enterprise Linux Desktop (v. 5 client) - i386, x86_64
Red Hat Enterprise Linux Desktop version 4 - i386, x86_64
Red Hat Enterprise Linux ES version 4 - i386, ia64, x86_64
Red Hat Enterprise Linux WS version 4 - i386, ia64, x86_64
3. Description:
Pidgin is an instant messaging program which can log in to multiple
accounts on multiple instant messaging networks simultaneously. The AOL
Open System for Communication in Realtime (OSCAR) protocol is used by the
AOL ICQ and AIM instant messaging systems.
An invalid pointer dereference bug was found in the way the Pidgin OSCAR
protocol implementation processed lists of contacts. A remote attacker
could send a specially-crafted contact list to a user running Pidgin,
causing Pidgin to crash. (CVE-2009-3615)
These packages upgrade Pidgin to version 2.6.3. Refer to the Pidgin release
notes for a full list of changes: http://developer.pidgin.im/wiki/ChangeLog
All Pidgin users should upgrade to these updated packages, which correct
this issue. Pidgin must be restarted for this update to take effect.
4. Solution:
Before applying this update, make sure that all previously-released
errata relevant to your system have been applied.
This update is available via Red Hat Network. Details on how to use
the Red Hat Network to apply this update are available at
http://kbase.redhat.com/faq/docs/DOC-11259
5. Bugs fixed (http://bugzilla.redhat.com/):
529357 - CVE-2009-3615 Pidgin: Invalid pointer dereference (crash) after receiving contacts from SIM IM client
These packages are GPG signed by Red Hat for security. Our key and
details on how to verify the signature are available from
https://www.redhat.com/security/team/key/#package
--
Enterprise-watch-list mailing list
Enterprise-watch-list@redhat.com
https://www.redhat.com/mailman/listinfo/enterprise-watch-list
02-18-2010, 03:12 PM
Moderate: pidgin security update
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
================================================== ===================
Red Hat Security Advisory
Synopsis: Moderate: pidgin security update
Advisory ID: RHSA-2010:0115-01
Product: Red Hat Enterprise Linux
Advisory URL: https://rhn.redhat.com/errata/RHSA-2010-0115.html
Issue date: 2010-02-18
CVE Names: CVE-2010-0277 CVE-2010-0420 CVE-2010-0423
================================================== ===================
1. Summary:
Updated pidgin packages that fix three security issues are now available
for Red Hat Enterprise Linux 4 and 5.
This update has been rated as having moderate security impact by the Red
Hat Security Response Team.
2. Relevant releases/architectures:
RHEL Desktop Workstation (v. 5 client) - i386, x86_64
RHEL Optional Productivity Applications (v. 5 server) - i386, x86_64
Red Hat Enterprise Linux AS version 4 - i386, ia64, ppc, x86_64
Red Hat Enterprise Linux Desktop (v. 5 client) - i386, x86_64
Red Hat Enterprise Linux Desktop version 4 - i386, x86_64
Red Hat Enterprise Linux ES version 4 - i386, ia64, x86_64
Red Hat Enterprise Linux WS version 4 - i386, ia64, x86_64
3. Description:
Pidgin is an instant messaging program which can log in to multiple
accounts on multiple instant messaging networks simultaneously.
An input sanitization flaw was found in the way Pidgin's MSN protocol
implementation handled MSNSLP invitations. A remote attacker could send a
specially-crafted INVITE request that would cause a denial of service
(memory corruption and Pidgin crash). (CVE-2010-0277)
A denial of service flaw was found in Finch's XMPP chat implementation,
when using multi-user chat. If a Finch user in a multi-user chat session
were to change their nickname to contain the HTML "br" element, it would
cause Finch to crash. (CVE-2010-0420)
Red Hat would like to thank Sadrul Habib Chowdhury of the Pidgin project
for responsibly reporting the CVE-2010-0420 issue.
A denial of service flaw was found in the way Pidgin processed emoticon
images. A remote attacker could flood the victim with emoticon images
during mutual communication, leading to excessive CPU use. (CVE-2010-0423)
These packages upgrade Pidgin to version 2.6.6. Refer to the Pidgin release
notes for a full list of changes: http://developer.pidgin.im/wiki/ChangeLog
All Pidgin users are advised to upgrade to these updated packages, which
correct these issues. Pidgin must be restarted for this update to take
effect.
4. Solution:
Before applying this update, make sure all previously-released errata
relevant to your system have been applied.
This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
http://kbase.redhat.com/faq/docs/DOC-11259
These packages are GPG signed by Red Hat for security. Our key and
details on how to verify the signature are available from
https://www.redhat.com/security/team/key/#package
--
Enterprise-watch-list mailing list
Enterprise-watch-list@redhat.com
https://www.redhat.com/mailman/listinfo/enterprise-watch-list
10-21-2010, 05:02 PM
Moderate: pidgin security update
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
================================================== ===================
Red Hat Security Advisory
Synopsis: Moderate: pidgin security update
Advisory ID: RHSA-2010:0788-01
Product: Red Hat Enterprise Linux
Advisory URL: https://rhn.redhat.com/errata/RHSA-2010-0788.html
Issue date: 2010-10-21
CVE Names: CVE-2010-1624 CVE-2010-3711
================================================== ===================
1. Summary:
Updated pidgin packages that fix multiple security issues are now available
for Red Hat Enterprise Linux 4 and 5.
The Red Hat Security Response Team has rated this update as having moderate
security impact. Common Vulnerability Scoring System (CVSS) base scores,
which give detailed severity ratings, are available for each vulnerability
from the CVE links in the References section.
2. Relevant releases/architectures:
RHEL Desktop Workstation (v. 5 client) - i386, x86_64
RHEL Optional Productivity Applications (v. 5 server) - i386, x86_64
Red Hat Enterprise Linux AS version 4 - i386, ia64, ppc, x86_64
Red Hat Enterprise Linux Desktop (v. 5 client) - i386, x86_64
Red Hat Enterprise Linux Desktop version 4 - i386, x86_64
Red Hat Enterprise Linux ES version 4 - i386, ia64, x86_64
Red Hat Enterprise Linux WS version 4 - i386, ia64, x86_64
3. Description:
Pidgin is an instant messaging program which can log in to multiple
accounts on multiple instant messaging networks simultaneously.
Multiple NULL pointer dereference flaws were found in the way Pidgin
handled Base64 decoding. A remote attacker could use these flaws to crash
Pidgin if the target Pidgin user was using the Yahoo! Messenger Protocol,
MSN, MySpace, or Extensible Messaging and Presence Protocol (XMPP) protocol
plug-ins, or using the Microsoft NT LAN Manager (NTLM) protocol for
authentication. (CVE-2010-3711)
A NULL pointer dereference flaw was found in the way the Pidgin MSN
protocol plug-in processed custom emoticon messages. A remote attacker
could use this flaw to crash Pidgin by sending specially-crafted emoticon
messages during mutual communication. (CVE-2010-1624)
Red Hat would like to thank the Pidgin project for reporting these issues.
Upstream acknowledges Daniel Atallah as the original reporter of
CVE-2010-3711, and Pierre Nogu�of Meta Security as the original reporter
of CVE-2010-1624.
All Pidgin users should upgrade to these updated packages, which contain
backported patches to resolve these issues. Pidgin must be restarted for
this update to take effect.
4. Solution:
Before applying this update, make sure all previously-released errata
relevant to your system have been applied.
This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
http://kbase.redhat.com/faq/docs/DOC-11259
5. Bugs fixed (http://bugzilla.redhat.com/):
589973 - CVE-2010-1624 Pidgin: MSN SLP emoticon DoS (NULL pointer dereference)
641921 - CVE-2010-3711 Pidgin (libpurple): Multiple DoS (crash) flaws by processing of unsanitized Base64 decoder values
These packages are GPG signed by Red Hat for security. Our key and
details on how to verify the signature are available from
https://www.redhat.com/security/team/key/#package
--
Enterprise-watch-list mailing list
Enterprise-watch-list@redhat.com
https://www.redhat.com/mailman/listinfo/enterprise-watch-list
11-16-2010, 04:50 PM
Moderate: pidgin security update
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
================================================== ===================
Red Hat Security Advisory
Synopsis: Moderate: pidgin security update
Advisory ID: RHSA-2010:0890-01
Product: Red Hat Enterprise Linux
Advisory URL: https://rhn.redhat.com/errata/RHSA-2010-0890.html
Issue date: 2010-11-16
CVE Names: CVE-2010-3711
================================================== ===================
1. Summary:
Updated pidgin packages that fix multiple security issues are now available
for Red Hat Enterprise Linux 6.
The Red Hat Security Response Team has rated this update as having moderate
security impact. A Common Vulnerability Scoring System (CVSS) base score,
which gives a detailed severity rating, is available from the CVE link in
the References section.
2. Relevant releases/architectures:
Red Hat Enterprise Linux Desktop (v. 6) - i386, x86_64
Red Hat Enterprise Linux Desktop Optional (v. 6) - i386, x86_64
Red Hat Enterprise Linux Server Optional (v. 6) - i386, ppc64, x86_64
Red Hat Enterprise Linux Workstation (v. 6) - i386, x86_64
Red Hat Enterprise Linux Workstation Optional (v. 6) - i386, x86_64
3. Description:
Pidgin is an instant messaging program which can log in to multiple
accounts on multiple instant messaging networks simultaneously.
Multiple NULL pointer dereference flaws were found in the way Pidgin
handled Base64 decoding. A remote attacker could use these flaws to crash
Pidgin if the target Pidgin user was using the Yahoo! Messenger Protocol,
MSN, MySpace, or Extensible Messaging and Presence Protocol (XMPP) protocol
plug-ins, or using the Microsoft NT LAN Manager (NTLM) protocol for
authentication. (CVE-2010-3711)
Red Hat would like to thank the Pidgin project for reporting these issues.
Upstream acknowledges Daniel Atallah as the original reporter.
All Pidgin users should upgrade to these updated packages, which contain a
backported patch to resolve these issues. Pidgin must be restarted for this
update to take effect.
4. Solution:
Before applying this update, make sure all previously-released errata
relevant to your system have been applied.
This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
http://kbase.redhat.com/faq/docs/DOC-11259
5. Bugs fixed (http://bugzilla.redhat.com/):
641921 - CVE-2010-3711 Pidgin (libpurple): Multiple DoS (crash) flaws by processing of unsanitized Base64 decoder values
These packages are GPG signed by Red Hat for security. Our key and
details on how to verify the signature are available from
https://www.redhat.com/security/team/key/#package
--
Enterprise-watch-list mailing list
Enterprise-watch-list@redhat.com
https://www.redhat.com/mailman/listinfo/enterprise-watch-list
10-14-2011, 03:34 AM
Moderate: pidgin security update
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
================================================== ===================
Red Hat Security Advisory
Synopsis: Moderate: pidgin security update
Advisory ID: RHSA-2011:1371-01
Product: Red Hat Enterprise Linux
Advisory URL: https://rhn.redhat.com/errata/RHSA-2011-1371.html
Issue date: 2011-10-13
CVE Names: CVE-2011-1091 CVE-2011-3594
================================================== ===================
1. Summary:
Updated pidgin packages that fix multiple security issues are now available
for Red Hat Enterprise Linux 4 and 5.
The Red Hat Security Response Team has rated this update as having moderate
security impact. Common Vulnerability Scoring System (CVSS) base scores,
which give detailed severity ratings, are available for each vulnerability
from the CVE links in the References section.
2. Relevant releases/architectures:
RHEL Desktop Workstation (v. 5 client) - i386, x86_64
RHEL Optional Productivity Applications (v. 5 server) - i386, x86_64
Red Hat Enterprise Linux AS version 4 - i386, ia64, ppc, x86_64
Red Hat Enterprise Linux Desktop (v. 5 client) - i386, x86_64
Red Hat Enterprise Linux Desktop version 4 - i386, x86_64
Red Hat Enterprise Linux ES version 4 - i386, ia64, x86_64
Red Hat Enterprise Linux WS version 4 - i386, ia64, x86_64
3. Description:
Pidgin is an instant messaging program which can log in to multiple
accounts on multiple instant messaging networks simultaneously.
An input sanitization flaw was found in the way the Pidgin SILC (Secure
Internet Live Conferencing) protocol plug-in escaped certain UTF-8
characters. A remote attacker could use this flaw to crash Pidgin via a
specially-crafted SILC message. (CVE-2011-3594)
Multiple NULL pointer dereference flaws were found in the way the Pidgin
Yahoo! Messenger Protocol plug-in handled malformed YMSG packets. A remote
attacker could use these flaws to crash Pidgin via a specially-crafted
notification message. (CVE-2011-1091)
Red Hat would like to thank the Pidgin project for reporting CVE-2011-1091.
Upstream acknowledges Marius Wachtler as the original reporter of
CVE-2011-1091.
All Pidgin users should upgrade to these updated packages, which contain
backported patches to resolve these issues. Pidgin must be restarted for
this update to take effect.
4. Solution:
Before applying this update, make sure all previously-released errata
relevant to your system have been applied.
This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
https://access.redhat.com/kb/docs/DOC-11259
These packages are GPG signed by Red Hat for security. Our key and
details on how to verify the signature are available from
https://access.redhat.com/security/team/key/#package
--
Enterprise-watch-list mailing list
Enterprise-watch-list@redhat.com
https://www.redhat.com/mailman/listinfo/enterprise-watch-list
12-14-2011, 06:05 PM
Moderate: pidgin security update
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
================================================== ===================
Red Hat Security Advisory
Synopsis: Moderate: pidgin security update
Advisory ID: RHSA-2011:1820-01
Product: Red Hat Enterprise Linux
Advisory URL: https://rhn.redhat.com/errata/RHSA-2011-1820.html
Issue date: 2011-12-14
CVE Names: CVE-2011-4601 CVE-2011-4602 CVE-2011-4603
================================================== ===================
1. Summary:
Updated pidgin packages that fix multiple security issues are now available
for Red Hat Enterprise Linux 4 and 5.
The Red Hat Security Response Team has rated this update as having moderate
security impact. Common Vulnerability Scoring System (CVSS) base scores,
which give detailed severity ratings, are available for each vulnerability
from the CVE links in the References section.
2. Relevant releases/architectures:
RHEL Desktop Workstation (v. 5 client) - i386, x86_64
RHEL Optional Productivity Applications (v. 5 server) - i386, x86_64
Red Hat Enterprise Linux AS version 4 - i386, ia64, ppc, x86_64
Red Hat Enterprise Linux Desktop (v. 5 client) - i386, x86_64
Red Hat Enterprise Linux Desktop version 4 - i386, x86_64
Red Hat Enterprise Linux ES version 4 - i386, ia64, x86_64
Red Hat Enterprise Linux WS version 4 - i386, ia64, x86_64
3. Description:
Pidgin is an instant messaging program which can log in to multiple
accounts on multiple instant messaging networks simultaneously.
An input sanitization flaw was found in the way the AOL Open System for
Communication in Realtime (OSCAR) protocol plug-in in Pidgin, used by the
AOL ICQ and AIM instant messaging systems, escaped certain UTF-8
characters. A remote attacker could use this flaw to crash Pidgin via a
specially-crafted OSCAR message. (CVE-2011-4601)
An input sanitization flaw was found in the way the Pidgin SILC (Secure
Internet Live Conferencing) protocol plug-in escaped certain UTF-8
characters in channel messages. A remote attacker could use this flaw to
crash Pidgin via a specially-crafted SILC message. (CVE-2011-4603)
Multiple NULL pointer dereference flaws were found in the Jingle extension
of the Extensible Messaging and Presence Protocol (XMPP) protocol plug-in
in Pidgin. A remote attacker could use these flaws to crash Pidgin via a
specially-crafted Jingle multimedia message. (CVE-2011-4602)
Red Hat would like to thank the Pidgin project for reporting these issues.
Upstream acknowledges Evgeny Boger as the original reporter of
CVE-2011-4601; Diego Bauche Madero from IOActive as the original reporter
of CVE-2011-4603; and Thijs Alkemade as the original reporter of
CVE-2011-4602.
All Pidgin users should upgrade to these updated packages, which contain
backported patches to resolve these issues. Pidgin must be restarted for
this update to take effect.
4. Solution:
Before applying this update, make sure all previously-released errata
relevant to your system have been applied.
This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
https://access.redhat.com/kb/docs/DOC-11259
5. Bugs fixed (http://bugzilla.redhat.com/):
761510 - CVE-2011-4602 pidgin: Multiple NULL pointer deference flaws by processing certain Jingle stanzas in the XMPP protocol plug-in
761517 - CVE-2011-4601 pidgin (libpurple): Invalid UTF-8 string handling in OSCAR messages
766446 - CVE-2011-4603 pidgin: SILC remote crash on channel messages
These packages are GPG signed by Red Hat for security. Our key and
details on how to verify the signature are available from
https://access.redhat.com/security/team/key/#package
--
Enterprise-watch-list mailing list
Enterprise-watch-list@redhat.com
https://www.redhat.com/mailman/listinfo/enterprise-watch-list
12-14-2011, 06:06 PM
Moderate: pidgin security update
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
================================================== ===================
Red Hat Security Advisory
Synopsis: Moderate: pidgin security update
Advisory ID: RHSA-2011:1821-01
Product: Red Hat Enterprise Linux
Advisory URL: https://rhn.redhat.com/errata/RHSA-2011-1821.html
Issue date: 2011-12-14
CVE Names: CVE-2011-4601 CVE-2011-4602
================================================== ===================
1. Summary:
Updated pidgin packages that fix multiple security issues are now available
for Red Hat Enterprise Linux 6.
The Red Hat Security Response Team has rated this update as having moderate
security impact. Common Vulnerability Scoring System (CVSS) base scores,
which give detailed severity ratings, are available for each vulnerability
from the CVE links in the References section.
2. Relevant releases/architectures:
Red Hat Enterprise Linux Desktop (v. 6) - i386, x86_64
Red Hat Enterprise Linux Desktop Optional (v. 6) - i386, x86_64
Red Hat Enterprise Linux Server Optional (v. 6) - i386, ppc64, x86_64
Red Hat Enterprise Linux Workstation (v. 6) - i386, x86_64
Red Hat Enterprise Linux Workstation Optional (v. 6) - i386, x86_64
3. Description:
Pidgin is an instant messaging program which can log in to multiple
accounts on multiple instant messaging networks simultaneously.
An input sanitization flaw was found in the way the AOL Open System for
Communication in Realtime (OSCAR) protocol plug-in in Pidgin, used by the
AOL ICQ and AIM instant messaging systems, escaped certain UTF-8
characters. A remote attacker could use this flaw to crash Pidgin via a
specially-crafted OSCAR message. (CVE-2011-4601)
Multiple NULL pointer dereference flaws were found in the Jingle extension
of the Extensible Messaging and Presence Protocol (XMPP) protocol plug-in
in Pidgin. A remote attacker could use these flaws to crash Pidgin via a
specially-crafted Jingle multimedia message. (CVE-2011-4602)
Red Hat would like to thank the Pidgin project for reporting these issues.
Upstream acknowledges Evgeny Boger as the original reporter of
CVE-2011-4601, and Thijs Alkemade as the original reporter of
CVE-2011-4602.
All Pidgin users should upgrade to these updated packages, which contain
backported patches to resolve these issues. Pidgin must be restarted for
this update to take effect.
4. Solution:
Before applying this update, make sure all previously-released errata
relevant to your system have been applied.
This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
https://access.redhat.com/kb/docs/DOC-11259
5. Bugs fixed (http://bugzilla.redhat.com/):
761510 - CVE-2011-4602 pidgin: Multiple NULL pointer deference flaws by processing certain Jingle stanzas in the XMPP protocol plug-in
761517 - CVE-2011-4601 pidgin (libpurple): Invalid UTF-8 string handling in OSCAR messages
These packages are GPG signed by Red Hat for security. Our key and
details on how to verify the signature are available from
https://access.redhat.com/security/team/key/#package
--
Enterprise-watch-list mailing list
Enterprise-watch-list@redhat.com
https://www.redhat.com/mailman/listinfo/enterprise-watch-list
07-19-2012, 03:41 PM
Moderate: pidgin security update
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
================================================== ===================
Red Hat Security Advisory
Synopsis: Moderate: pidgin security update
Advisory ID: RHSA-2012:1102-01
Product: Red Hat Enterprise Linux
Advisory URL: https://rhn.redhat.com/errata/RHSA-2012-1102.html
Issue date: 2012-07-19
CVE Names: CVE-2012-1178 CVE-2012-2318 CVE-2012-3374
================================================== ===================
1. Summary:
Updated pidgin packages that fix three security issues are now available
for Red Hat Enterprise Linux 5 and 6.
The Red Hat Security Response Team has rated this update as having moderate
security impact. Common Vulnerability Scoring System (CVSS) base scores,
which give detailed severity ratings, are available for each vulnerability
from the CVE links in the References section.
2. Relevant releases/architectures:
RHEL Desktop Workstation (v. 5 client) - i386, x86_64
RHEL Optional Productivity Applications (v. 5 server) - i386, x86_64
Red Hat Enterprise Linux Desktop (v. 5 client) - i386, x86_64
Red Hat Enterprise Linux Desktop (v. 6) - i386, x86_64
Red Hat Enterprise Linux Desktop Optional (v. 6) - i386, x86_64
Red Hat Enterprise Linux Server Optional (v. 6) - i386, ppc64, x86_64
Red Hat Enterprise Linux Workstation (v. 6) - i386, x86_64
Red Hat Enterprise Linux Workstation Optional (v. 6) - i386, x86_64
3. Description:
Pidgin is an instant messaging program which can log in to multiple
accounts on multiple instant messaging networks simultaneously.
A flaw was found in the way the Pidgin MSN protocol plug-in processed text
that was not encoded in UTF-8. A remote attacker could use this flaw to
crash Pidgin by sending a specially-crafted MSN message. (CVE-2012-1178)
An input validation flaw was found in the way the Pidgin MSN protocol
plug-in handled MSN notification messages. A malicious server or a remote
attacker could use this flaw to crash Pidgin by sending a specially-crafted
MSN notification message. (CVE-2012-2318)
A buffer overflow flaw was found in the Pidgin MXit protocol plug-in. A
remote attacker could use this flaw to crash Pidgin by sending a MXit
message containing specially-crafted emoticon tags. (CVE-2012-3374)
Red Hat would like to thank the Pidgin project for reporting the
CVE-2012-3374 issue. Upstream acknowledges Ulf Härnhammar as the original
reporter of CVE-2012-3374.
All Pidgin users should upgrade to these updated packages, which contain
backported patches to resolve these issues. Pidgin must be restarted for
this update to take effect.
4. Solution:
Before applying this update, make sure all previously-released errata
relevant to your system have been applied.
This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
https://access.redhat.com/knowledge/articles/11258
5. Bugs fixed (http://bugzilla.redhat.com/):
803298 - CVE-2012-1178 pidgin: Client abort in the MSN protocol plug-in by attempt to display certain, not UTF-8 encoded text
819446 - CVE-2012-2318 pidgin: Improper validation of incoming plaintext messages in MSN protocol plug-in
837319 - CVE-2012-3374 pidgin: Stack-based buffer overwrite in MXit protocol libPurple plug-in
These packages are GPG signed by Red Hat for security. Our key and
details on how to verify the signature are available from
https://access.redhat.com/security/team/key/#package
Moderate: pidgin security update
