Red Hat Security Advisory

RHSA-2011:1820

pidgin security update

Released 2011-12-14 · Red Hat rating Moderate · View on Red Hat →

Fixed in

RHEL Desktop Workstation (v. 5 client) finch-devel-2.6.6-5.el5_7.4, finch-devel-2.6.6-5.el5_7.4.i386, libpurple-devel-2.6.6-5.el5_7.4 +4
RHEL Optional Productivity Applications (v. 5 server) finch-2.6.6-5.el5_7.4, finch-2.6.6-5.el5_7.4.i386, finch-devel-2.6.6-5.el5_7.4 +15
Red Hat Enterprise Linux AS version 4 finch-2.6.6-10.el4, finch-2.6.6-10.el4.i386, finch-2.6.6-10.el4.ia64 +33
Red Hat Enterprise Linux Desktop (v. 5 client) finch-2.6.6-5.el5_7.4, finch-2.6.6-5.el5_7.4.i386, libpurple-2.6.6-5.el5_7.4 +9
Red Hat Enterprise Linux Desktop version 4 finch-2.6.6-10.el4, finch-2.6.6-10.el4.i386, finch-devel-2.6.6-10.el4 +15
Red Hat Enterprise Linux ES version 4 finch-2.6.6-10.el4, finch-2.6.6-10.el4.i386, finch-2.6.6-10.el4.ia64 +24
Red Hat Enterprise Linux WS version 4 finch-2.6.6-10.el4, finch-2.6.6-10.el4.i386, finch-2.6.6-10.el4.ia64 +24

Fixes 3 records

TI-2011-03967 CVE-2011-4601 · GHSA-j8rm-cj64-mfw6

family_feedbag.c in the oscar protocol plugin in libpurple in Pidgin before 2.10.1 does…

LOW 30

family_feedbag.c in the oscar protocol plugin in libpurple in Pidgin before 2.10.1 does not perform the expected UTF-8 validation on message data, which allows remote attackers to cause a denial of service (application c…

CVSS 2.0MEDIUM 5.0 Network No auth Interaction — EPSS 0.04528 Published 2011-12-25 Fixed CWE-20

TI-2011-03969 CVE-2011-4603 · GHSA-6f79-g335-f9mf

The silc_channel_message function in ops.c in the SILC protocol plugin in libpurple in…

LOW 29

The silc_channel_message function in ops.c in the SILC protocol plugin in libpurple in Pidgin before 2.10.1 does not perform the expected UTF-8 validation on message data, which allows remote attackers to cause a denial…

CVSS 2.0MEDIUM 5.0 Network No auth Interaction — EPSS 0.036 Published 2011-12-17 Fixed CWE-20

TI-2011-03968 CVE-2011-4602 · GHSA-f6vj-77mr-4rfr

The XMPP protocol plugin in libpurple in Pidgin before 2.10.1 does not properly handle…

LOW 29

The XMPP protocol plugin in libpurple in Pidgin before 2.10.1 does not properly handle missing fields in (1) voice-chat and (2) video-chat stanzas, which allows remote attackers to cause a denial of service (application…

CVSS 2.0MEDIUM 5.0 Network No auth Interaction — EPSS 0.03583 Published 2011-12-17 Fixed CWE-20