Red Hat Security AdvisoryRHSA-2012:1102
pidgin security update
Released 2012-07-19 · Red Hat rating Moderate · View on Red Hat →
Fixed in
- RHEL Desktop Workstation (v. 5 client) finch-devel-2.6.6-11.el5.4, finch-devel-2.6.6-11.el5.4.i386, libpurple-devel-2.6.6-11.el5.4 +4
- RHEL Optional Productivity Applications (v. 5 server) finch-2.6.6-11.el5.4, finch-2.6.6-11.el5.4.i386, finch-devel-2.6.6-11.el5.4 +15
- Red Hat Enterprise Linux Desktop (v. 5 client) finch-2.6.6-11.el5.4, finch-2.6.6-11.el5.4.i386, libpurple-2.6.6-11.el5.4 +9
- Red Hat Enterprise Linux Desktop (v. 6) libpurple-2.7.9-5.el6.2, pidgin-2.7.9-5.el6.2
- Red Hat Enterprise Linux Desktop Optional (v. 6) finch-2.7.9-5.el6.2, finch-devel-2.7.9-5.el6.2, libpurple-devel-2.7.9-5.el6.2 +6
- Red Hat Enterprise Linux Server Optional (v. 6) finch-2.7.9-5.el6.2, finch-2.7.9-5.el6.2.ppc, finch-devel-2.7.9-5.el6.2 +12
- Red Hat Enterprise Linux Workstation (v. 6) libpurple-2.7.9-5.el6.2, pidgin-2.7.9-5.el6.2
- Red Hat Enterprise Linux Workstation Optional (v. 6) finch-2.7.9-5.el6.2, finch-devel-2.7.9-5.el6.2, libpurple-devel-2.7.9-5.el6.2 +6
Fixes 3 records
Priority MEDIUM 42
Buffer overflow in markup.c in the MXit protocol plugin in libpurple in Pidgin before 2.10.5 allows remote attackers to execute arbitrary code via a crafted inline image in a message.
CVSS 2.0HIGH 7.5· Network · No auth · Interaction — · EPSS 0.06402 · Published 2012-07-07 · Fixed CWE-119
Priority LOW 27
The msn_oim_report_to_user function in oim.c in the MSN protocol plugin in libpurple in Pidgin before 2.10.2 allows remote servers to cause a denial of service (application crash) via an OIM message that lacks UTF-8 enco…
CVSS 2.0MEDIUM 5.0· Network · No auth · Interaction — · EPSS 0.02386 · Published 2012-03-15 · Fixed CWE-399
Priority LOW 26
msg.c in the MSN protocol plugin in libpurple in Pidgin before 2.10.4 does not properly handle crafted characters, which allows remote servers to cause a denial of service (application crash) by placing these characters…
CVSS 2.0MEDIUM 5.0· Network · No auth · Interaction — · EPSS 0.01694 · Published 2012-07-03 · Fixed CWE-20
THREATIST.IORead the docs