pidgin was updated to fix 4 security issues :

  - Fixed a crash when receiving UPnP responses with     abnormally long values. (CVE-2013-0274, bnc#804742)

  - Fixed a crash in Sametime protocol when a malicious     server sends us an abnormally long user ID.
    (CVE-2013-0273, bnc#804742)

  - Fixed a bug where the MXit server or a man-in-the-middle     could potentially send specially crafted data that could     overflow a buffer and lead to a crash or remote code     execution. (CVE-2013-0272, bnc#804742)

  - Fixed a bug where a remote MXit user could possibly     specify a local file path to be written to.
    (CVE-2013-0271, bnc#804742)

Updated pidgin packages that fix three security issues are now available for Red Hat Enterprise Linux 5 and 6.

The Red Hat Security Response Team has rated this update as having moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

Pidgin is an instant messaging program which can log in to multiple accounts on multiple instant messaging networks simultaneously.

A stack-based buffer overflow flaw was found in the Pidgin MXit protocol plug-in. A malicious server or a remote attacker could use this flaw to crash Pidgin by sending a specially crafted HTTP request.
(CVE-2013-0272)

A buffer overflow flaw was found in the Pidgin Sametime protocol plug-in. A malicious server or a remote attacker could use this flaw to crash Pidgin by sending a specially crafted username.
(CVE-2013-0273)

A buffer overflow flaw was found in the way Pidgin processed certain UPnP responses. A remote attacker could send a specially crafted UPnP response that, when processed, would crash Pidgin. (CVE-2013-0274)

Red Hat would like to thank the Pidgin project for reporting the above issues. Upstream acknowledges Daniel Atallah as the original reporter of CVE-2013-0272.

All Pidgin users should upgrade to these updated packages, which contain backported patches to resolve these issues. Pidgin must be restarted for this update to take effect.

Chris Wysopal discovered that Pidgin incorrectly handled file transfers in the MXit protocol handler. A remote attacker could use this issue to create or overwrite arbitrary files. This issue only affected Ubuntu 11.10, Ubuntu 12.04 LTS and Ubuntu 12.10.
(CVE-2013-0271)

It was discovered that Pidgin incorrectly handled long HTTP headers in the MXit protocol handler. A malicious remote server could use this issue to execute arbitrary code. (CVE-2013-0272)

It was discovered that Pidgin incorrectly handled long user IDs in the Sametime protocol handler. A malicious remote server could use this issue to cause Pidgin to crash, resulting in a denial of service.
(CVE-2013-0273)

It was discovered that Pidgin incorrectly handled long strings when processing UPnP responses. A remote attacker could use this issue to cause Pidgin to crash, resulting in a denial of service.
(CVE-2013-0274).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is affected by the vulnerability described in GLSA-201405-22 (Pidgin: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Pidgin. Please review       the CVE identifiers referenced below for details.
  Impact :

    A remote attacker could possibly execute arbitrary code with the       privileges of the Pidgin process, cause a Denial of Service condition,       overwrite files, or spoof traffic.
  Workaround :

    There is no known workaround at this time.

pidgin was updated to fix security issues :

  - Fix a crash when receiving UPnP responses with     abnormally long values. (CVE-2013-0274)

  - Fix a crash in Sametime when a malicious server sends us     an abnormally long user ID. (CVE-2013-0273)

  - Fix a bug where the MXit server or a man-in-the-middle     could potentially send specially crafted data that could     overflow a buffer and lead to a crash or remote code     execution.(CVE-2013-0272)

  - Fix a bug where a remote MXit user could possibly     specify a local file path to be written to.
    (CVE-2013-0271)

A stack-based buffer overflow flaw was found in the Pidgin MXit protocol plug-in. A malicious server or a remote attacker could use this flaw to crash Pidgin by sending a specially crafted HTTP request.
(CVE-2013-0272)

A buffer overflow flaw was found in the Pidgin Sametime protocol plug-in. A malicious server or a remote attacker could use this flaw to crash Pidgin by sending a specially crafted username.
(CVE-2013-0273)

A buffer overflow flaw was found in the way Pidgin processed certain UPnP responses. A remote attacker could send a specially crafted UPnP response that, when processed, would crash Pidgin. (CVE-2013-0274)

Pidgin must be restarted for this update to take effect.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - upnp.c in libpurple in Pidgin before 2.10.7 does not properly terminate long strings in UPnP responses,     which allows remote attackers to cause a denial of service (application crash) by leveraging access to the     local network. (CVE-2013-0274)

Note that Nessus relies on the presence of the package as reported by the vendor.

New pidgin packages are available for Slackware 12.2, 13.0, 13.1, 13.37, 14.0, and -current to fix security issues.

The remote Oracle Linux 5 / 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2013-0646 advisory.

    - Add patch for CVE-2013-0274 (RH bug #910653).
    - Add patch for CVE-2013-0273 (RH bug #910653).
    - Add patch for CVE-2013-0272 (RH bug #910653).
    - Add patch for CVE-2011-2485 (RH bug #837562).
    - Add patch for CVE-2012-1178 (RH bug #837560).
    - Add patch for CVE-2012-2318 (RH bug #837560).

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
65026	SuSE 10 Security Update : pidgin (ZYPP Patch Number 8475)	Nessus	SuSE Local Security Checks	2013/3/5	2021/1/19	medium
65555	CentOS 5 / 6 : pidgin (CESA-2013:0646)	Nessus	CentOS Local Security Checks	2013/3/15	2021/1/4	medium
64890	Ubuntu 10.04 LTS / 11.10 / 12.04 LTS / 12.10 : pidgin vulnerabilities (USN-1746-1)	Nessus	Ubuntu Local Security Checks	2013/2/26	2019/9/19	medium
74064	GLSA-201405-22 : Pidgin: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	2014/5/19	2021/1/6	critical
74915	openSUSE Security Update : pidgin (openSUSE-SU-2013:0405-1)	Nessus	SuSE Local Security Checks	2014/6/13	2021/1/19	medium
65565	Scientific Linux Security Update : pidgin on SL5.x, SL6.x i386/x86_64 (20130314)	Nessus	Scientific Linux Local Security Checks	2013/3/15	2021/1/14	medium
217877	Linux Distros Unpatched Vulnerability : CVE-2013-0274	Nessus	Misc.	2025/3/4	2026/1/28	high
64622	Slackware 12.2 / 13.0 / 13.1 / 13.37 / 14.0 / current : pidgin (SSA:2013-044-01)	Nessus	Slackware Local Security Checks	2013/2/14	2021/1/14	medium
65561	RHEL 5 / 6 : pidgin (RHSA-2013:0646)	Nessus	Red Hat Local Security Checks	2013/3/15	2021/1/14	medium
68791	Oracle Linux 5 / 6 : pidgin (ELSA-2013-0646)	Nessus	Oracle Linux Local Security Checks	2013/7/12	2025/4/29	high

检测

插件搜索

medium

medium

medium

critical

medium

medium

high

medium

medium

high