Moderate CentOS pidgin Update

Metadata

critical
10.0
finch-2.6.6-32.el5.i386.rpm, finch-2.6.6-32.el5.x86_64.rpm, finch-2.7.9-27.el6.i686.rpm, finch-2.7.9-27.el6.x86_64.rpm, finch-devel-2.6.6-32.el5.i386.rpm, finch-devel-2.6.6-32.el5.x86_64.rpm, finch-devel-2.7.9-27.el6.i686.rpm, finch-devel-2.7.9-27.el6.x86_64.rpm, libpurple-2.6.6-32.el5.i386.rpm, libpurple-2.6.6-32.el5.x86_64.rpm, libpurple-2.7.9-27.el6.i686.rpm, libpurple-2.7.9-27.el6.x86_64.rpm, libpurple-devel-2.6.6-32.el5.i386.rpm, libpurple-devel-2.6.6-32.el5.x86_64.rpm, libpurple-devel-2.7.9-27.el6.i686.rpm, libpurple-devel-2.7.9-27.el6.x86_64.rpm, libpurple-perl-2.6.6-32.el5.i386.rpm, libpurple-perl-2.6.6-32.el5.x86_64.rpm, libpurple-perl-2.7.9-27.el6.i686.rpm, libpurple-perl-2.7.9-27.el6.x86_64.rpm, libpurple-tcl-2.6.6-32.el5.i386.rpm, libpurple-tcl-2.6.6-32.el5.x86_64.rpm, libpurple-tcl-2.7.9-27.el6.i686.rpm, libpurple-tcl-2.7.9-27.el6.x86_64.rpm, pidgin-2.6.6-32.el5.i386.rpm, pidgin-2.6.6-32.el5.src.rpm, pidgin-2.6.6-32.el5.x86_64.rpm, pidgin-2.7.9-27.el6.i686.rpm, pidgin-2.7.9-27.el6.src.rpm, pidgin-2.7.9-27.el6.x86_64.rpm, pidgin-devel-2.6.6-32.el5.i386.rpm, pidgin-devel-2.6.6-32.el5.x86_64.rpm, pidgin-devel-2.7.9-27.el6.i686.rpm, pidgin-devel-2.7.9-27.el6.x86_64.rpm, pidgin-docs-2.7.9-27.el6.i686.rpm, pidgin-docs-2.7.9-27.el6.x86_64.rpm, pidgin-perl-2.6.6-32.el5.i386.rpm, pidgin-perl-2.6.6-32.el5.x86_64.rpm, pidgin-perl-2.7.9-27.el6.i686.rpm, pidgin-perl-2.7.9-27.el6.x86_64.rpm
CVE-2012-6152, CVE-2013-6477, CVE-2013-6478, CVE-2013-6479, CVE-2013-6481, CVE-2013-6482, CVE-2013-6483, CVE-2013-6484, CVE-2013-6485, CVE-2013-6487, CVE-2013-6489, CVE-2013-6490, CVE-2014-0020
rhn.redhat.com, lists.centos.org, lists.centos.org
2014-02-05
2017-07-27 19:06
CVE-2013-6485 pidgin
CVE-2013-6479 pidgin
CVE-2013-6489 pidgin
CVE-2013-6484 pidgin
CVE-2013-6477 pidgin
CVE-2013-6490 pidgin
CVE-2014-0020 pidgin
CVE-2013-6482 pidgin
CVE-2013-6487 pidgin
CVE-2013-6483 pidgin
CVE-2012-6152 pidgin
CVE-2013-6487 libgadu
CVE-2013-6481 pidgin
CVE-2013-6478 pidgin
CVE-2012-6152
CVE-2013-6481
CVE-2013-6490
CVE-2013-6489
CVE-2013-6484
CVE-2013-6485
CVE-2013-6483
CVE-2013-6478
CVE-2013-6479
CVE-2013-6477
CVE-2014-0020
CVE-2013-6482
CVE-2013-6487
2017-04-01 19:07
2017-01-05 20:11

Description


Updated pidgin packages that fix multiple security issues are now available
for Red Hat Enterprise Linux 5 and 6.

The Red Hat Security Response Team has rated this update as having moderate
security impact. Common Vulnerability Scoring System (CVSS) base scores,
which give detailed severity ratings, are available for each vulnerability
from the CVE links in the References section.

Pidgin is an instant messaging program which can log in to multiple
accounts on multiple instant messaging networks simultaneously.

A heap-based buffer overflow flaw was found in the way Pidgin processed
certain HTTP responses. A malicious server could send a specially crafted
HTTP response, causing Pidgin to crash or potentially execute arbitrary
code with the permissions of the user running Pidgin. (CVE-2013-6485)

Multiple heap-based buffer overflow flaws were found in several protocol
plug-ins in Pidgin (Gadu-Gadu, MXit, SIMPLE). A malicious server could send
a specially crafted message, causing Pidgin to crash or potentially execute
arbitrary code with the permissions of the user running Pidgin.
(CVE-2013-6487, CVE-2013-6489, CVE-2013-6490)

Multiple denial of service flaws were found in several protocol plug-ins in
Pidgin (Yahoo!, XMPP, MSN, stun, IRC). A remote attacker could use these
flaws to crash Pidgin by sending a specially crafted message.
(CVE-2012-6152, CVE-2013-6477, CVE-2013-6481, CVE-2013-6482, CVE-2013-6484,
CVE-2014-0020)

It was found that the Pidgin XMPP protocol plug-in did not verify the
origin of "iq" replies. A remote attacker could use this flaw to spoof an
"iq" reply, which could lead to injection of fake data or cause Pidgin to
crash via a NULL pointer dereference. (CVE-2013-6483)

A flaw was found in the way Pidgin parsed certain HTTP response headers.
A remote attacker could use this flaw to crash Pidgin via a specially
crafted HTTP response header. (CVE-2013-6479)

It was found that Pidgin crashed when a mouse pointer was hovered over a
long URL. A remote attacker could use this flaw to crash Pidgin by sending
a message containing a long URL string. (CVE-2013-6478)

Red Hat would like to thank the Pidgin project for reporting these issues.
Upstream acknowledges Thijs Alkemade, Robert Vehse, Jaime Breva Ribes,
Jacob Appelbaum of the Tor Project, Daniel Atallah, Fabian Yamaguchi and
Christian Wressnegger of the University of Goettingen, Matt Jones of
Volvent, and Yves Younan, Ryan Pentney, and Pawel Janic of Sourcefire VRT
as the original reporters of these issues.

All pidgin users are advised to upgrade to these updated packages, which
contain backported patches to correct these issues. Pidgin must be
restarted for this update to take effect.
Please see https://www.redhat.com/footer/terms-of-use.html

Am I vulnerable?

The constraints below list the versions that this vulnerability is patched in, and versions that are unaffected. If a patch is ready but unrealeased, then it is pending.

Or, you can just let us figure it out for you! Appcanary continously monitor your installed packages, and tell you if any of them are vulnerable.

Sign up for monitoring

Affected package information

Release Package Patched in
5 finch finch-2.6.6-32.el5.i386.rpm
finch finch-2.6.6-32.el5.x86_64.rpm
finch-devel finch-devel-2.6.6-32.el5.i386.rpm
finch-devel finch-devel-2.6.6-32.el5.x86_64.rpm
libpurple libpurple-2.6.6-32.el5.i386.rpm
libpurple libpurple-2.6.6-32.el5.x86_64.rpm
libpurple-devel libpurple-devel-2.6.6-32.el5.i386.rpm
libpurple-devel libpurple-devel-2.6.6-32.el5.x86_64.rpm
libpurple-perl libpurple-perl-2.6.6-32.el5.i386.rpm
libpurple-perl libpurple-perl-2.6.6-32.el5.x86_64.rpm
libpurple-tcl libpurple-tcl-2.6.6-32.el5.i386.rpm
libpurple-tcl libpurple-tcl-2.6.6-32.el5.x86_64.rpm
pidgin pidgin-2.6.6-32.el5.i386.rpm
pidgin pidgin-2.6.6-32.el5.src.rpm
pidgin pidgin-2.6.6-32.el5.x86_64.rpm
pidgin-devel pidgin-devel-2.6.6-32.el5.i386.rpm
pidgin-devel pidgin-devel-2.6.6-32.el5.x86_64.rpm
pidgin-perl pidgin-perl-2.6.6-32.el5.i386.rpm
pidgin-perl pidgin-perl-2.6.6-32.el5.x86_64.rpm
6 finch finch-2.7.9-27.el6.i686.rpm
finch finch-2.7.9-27.el6.x86_64.rpm
finch-devel finch-devel-2.7.9-27.el6.i686.rpm
finch-devel finch-devel-2.7.9-27.el6.x86_64.rpm
libpurple libpurple-2.7.9-27.el6.i686.rpm
libpurple libpurple-2.7.9-27.el6.x86_64.rpm
libpurple-devel libpurple-devel-2.7.9-27.el6.i686.rpm
libpurple-devel libpurple-devel-2.7.9-27.el6.x86_64.rpm
libpurple-perl libpurple-perl-2.7.9-27.el6.i686.rpm
libpurple-perl libpurple-perl-2.7.9-27.el6.x86_64.rpm
libpurple-tcl libpurple-tcl-2.7.9-27.el6.i686.rpm
libpurple-tcl libpurple-tcl-2.7.9-27.el6.x86_64.rpm
pidgin pidgin-2.7.9-27.el6.i686.rpm
pidgin pidgin-2.7.9-27.el6.src.rpm
pidgin pidgin-2.7.9-27.el6.x86_64.rpm
pidgin-devel pidgin-devel-2.7.9-27.el6.i686.rpm
pidgin-devel pidgin-devel-2.7.9-27.el6.x86_64.rpm
pidgin-docs pidgin-docs-2.7.9-27.el6.i686.rpm
pidgin-docs pidgin-docs-2.7.9-27.el6.x86_64.rpm
pidgin-perl pidgin-perl-2.7.9-27.el6.i686.rpm
pidgin-perl pidgin-perl-2.7.9-27.el6.x86_64.rpm