New pidgin packages are available for Slackware 13.0, 13.1, 13.37, 14.0, 14.1, and -current to fix security issues.

The remote Redhat Enterprise Linux 5 / 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2014:0139 advisory.

    Pidgin is an instant messaging program which can log in to multiple     accounts on multiple instant messaging networks simultaneously.

    A heap-based buffer overflow flaw was found in the way Pidgin processed     certain HTTP responses. A malicious server could send a specially crafted     HTTP response, causing Pidgin to crash or potentially execute arbitrary     code with the permissions of the user running Pidgin. (CVE-2013-6485)

    Multiple heap-based buffer overflow flaws were found in several protocol     plug-ins in Pidgin (Gadu-Gadu, MXit, SIMPLE). A malicious server could send     a specially crafted message, causing Pidgin to crash or potentially execute     arbitrary code with the permissions of the user running Pidgin.
    (CVE-2013-6487, CVE-2013-6489, CVE-2013-6490)

    Multiple denial of service flaws were found in several protocol plug-ins in     Pidgin (Yahoo!, XMPP, MSN, stun, IRC). A remote attacker could use these     flaws to crash Pidgin by sending a specially crafted message.
    (CVE-2012-6152, CVE-2013-6477, CVE-2013-6481, CVE-2013-6482, CVE-2013-6484,     CVE-2014-0020)

    It was found that the Pidgin XMPP protocol plug-in did not verify the     origin of iq replies. A remote attacker could use this flaw to spoof an     iq reply, which could lead to injection of fake data or cause Pidgin to     crash via a NULL pointer dereference. (CVE-2013-6483)

    A flaw was found in the way Pidgin parsed certain HTTP response headers.
    A remote attacker could use this flaw to crash Pidgin via a specially     crafted HTTP response header. (CVE-2013-6479)

    It was found that Pidgin crashed when a mouse pointer was hovered over a     long URL. A remote attacker could use this flaw to crash Pidgin by sending     a message containing a long URL string. (CVE-2013-6478)

    Red Hat would like to thank the Pidgin project for reporting these issues.
    Upstream acknowledges Thijs Alkemade, Robert Vehse, Jaime Breva Ribes,     Jacob Appelbaum of the Tor Project, Daniel Atallah, Fabian Yamaguchi and     Christian Wressnegger of the University of Goettingen, Matt Jones of     Volvent, and Yves Younan, Ryan Pentney, and Pawel Janic of Sourcefire VRT     as the original reporters of these issues.

    All pidgin users are advised to upgrade to these updated packages, which     contain backported patches to correct these issues. Pidgin must be     restarted for this update to take effect.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Multiple vulnerabilities have been discovered in Pidgin, a multi-protocol instant messaging client :

  - CVE-2013-6477     Jaime Breva Ribes discovered that a remote XMPP user can     trigger a crash by sending a message with a timestamp in     the distant future.

  - CVE-2013-6478     Pidgin could be crashed through overly wide tooltip     windows.

  - CVE-2013-6479     Jacob Appelbaum discovered that a malicious server or a     'man in the middle' could send a malformed HTTP header     resulting in denial of service.

  - CVE-2013-6481     Daniel Atallah discovered that Pidgin could be crashed     through malformed Yahoo! P2P messages.

  - CVE-2013-6482     Fabian Yamaguchi and Christian Wressnegger discovered     that Pidgin could be crashed through malformed MSN     messages.

  - CVE-2013-6483     Fabian Yamaguchi and Christian Wressnegger discovered     that Pidgin could be crashed through malformed XMPP     messages.

  - CVE-2013-6484     It was discovered that incorrect error handling when     reading the response from a STUN server could result in     a crash.

  - CVE-2013-6485     Matt Jones discovered a buffer overflow in the parsing     of malformed HTTP responses.

  - CVE-2013-6487     Yves Younan and Ryan Pentney discovered a buffer     overflow when parsing Gadu-Gadu messages.

  - CVE-2013-6489     Yves Younan and Pawel Janic discovered an integer     overflow when parsing MXit emoticons.

  - CVE-2013-6490     Yves Younan discovered a buffer overflow when parsing     SIMPLE headers.

  - CVE-2014-0020     Daniel Atallah discovered that Pidgin could be crashed     via malformed IRC arguments.

- Update to version 2.10.8 (bnc#861019) :

  + General: Python build scripts and example plugins are     now compatible with Python 3 (pidgin.im#15624).

  + libpurple :

  - Fix potential crash if libpurple gets an error     attempting to read a reply from a STUN server     (CVE-2013-6484).

  - Fix potential crash parsing a malformed HTTP response     (CVE-2013-6479).

  - Fix buffer overflow when parsing a malformed HTTP     response with chunked Transfer-Encoding (CVE-2013-6485).

  - Better handling of HTTP proxy responses with negative     Content-Lengths.

  - Fix handling of SSL certificates without subjects when     using libnss.

  - Fix handling of SSL certificates with timestamps in the     distant future when using libnss (pidgin.im#15586).

  - Impose maximum download size for all HTTP fetches.

  + Pidgin :

  - Fix crash displaying tooltip of long URLs     (CVE-2013-6478).

  - Better handling of URLs longer than 1000 letters.

  - Fix handling of multibyte UTF-8 characters in smiley     themes (pidgin.im#15756).

  + AIM: Fix untrusted certificate error.

  + AIM and ICQ: Fix a possible crash when receiving a     malformed message in a Direct IM session.

  + Gadu-Gadu :

  - Fix buffer overflow with remote code execution     potential. Only triggerable by a Gadu-Gadu server or a     man-in-the-middle (CVE-2013-6487).

  - Disabled buddy list import/export from/to server.

  - Disabled new account registration and password change     options.

  + IRC :

  - Fix bug where a malicious server or man-in-the-middle     could trigger a crash by not sending enough arguments     with various messages (CVE-2014-0020).

  - Fix bug where initial IRC status would not be set     correctly.

  - Fix bug where IRC wasn't available when libpurple was     compiled with Cyrus SASL support (pidgin.im#15517).

  + MSN :

  - Fix NULL pointer dereference parsing headers in MSN     (CVE-2013-6482).

  - Fix NULL pointer dereference parsing OIM data in MSN     (CVE-2013-6482).

  - Fix NULL pointer dereference parsing SOAP data in MSN     (CVE-2013-6482).

  - Fix possible crash when sending very long messages. Not     remotely-triggerable.

  + MXit :

  - Fix buffer overflow with remote code execution potential     (CVE-2013-6487).

  - Fix sporadic crashes that can happen after user is     disconnected.

  - Fix crash when attempting to add a contact via search     results.

  - Show error message if file transfer fails.

  - Fix compiling with InstantBird.

  - Fix display of some custom emoticons.

  + SILC: Correctly set whiteboard dimensions in whiteboard     sessions.

  + SIMPLE: Fix buffer overflow with remote code execution     potential (CVE-2013-6487).

  + XMPP :

  - Prevent spoofing of iq replies by verifying that the     'from' address matches the 'to' address of the iq     request (CVE-2013-6483).

  - Fix crash on some systems when receiving fake delay     timestamps with extreme values (CVE-2013-6477).

  - Fix possible crash or other erratic behavior when     selecting a very small file for your own buddy icon.

  - Fix crash if the user tries to initiate a voice/video     session with a resourceless JID.

  - Fix login errors when the first two available auth     mechanisms fail but a subsequent mechanism would     otherwise work when using Cyrus SASL (pidgin.im#15524).

  - Fix dropping incoming stanzas on BOSH connections when     we receive multiple HTTP responses at once     (pidgin.im#15684).

  + Yahoo! :

  - Fix possible crashes handling incoming strings that are     not UTF-8 (CVE-2012-6152).

  - Fix a bug reading a peer to peer message where a remote     user could trigger a crash (CVE-2013-6481).

  + Plugins :

  - Fix crash in contact availability plugin.

  - Fix perl function Purple::Network::ip_atoi.

  - Add Unity integration plugin.

  + Windows specific fixes: (CVE-2013-6486, pidgin.im#15520,     pidgin.im#15521, bgo#668154).

  - Drop pidgin-irc-sasl.patch, fixed upstream.

  - Obsolete pidgin-facebookchat: the package is no longer     maintained and pidgin as built-in support for Facebook     Chat.

  - Protect buildrequires for mono-devel with with_mono     macro.

  - Add pidgin-gstreamer1.patch: Port to GStreamer 1.0. Only     enabled on openSUSE 13.1 and newer.

  - On openSUSE 13.1 and newer, use gstreamer-devel and     gstreamer-plugins-base-devel BuildRequires.

The remote Solaris system is missing necessary patches to address security updates :

  - The Yahoo! protocol plugin in libpurple in Pidgin before     2.10.8 does not properly validate UTF-8 data, which     allows remote attackers to cause a denial of service     (application crash) via crafted byte sequences.
    (CVE-2012-6152)

  - The MXit protocol plugin in libpurple in Pidgin before     2.10.7 might allow remote attackers to create or     overwrite files via a crafted (1) mxit or (2)     mxit/imagestrips pathname. (CVE-2013-0271)

  - Buffer overflow in http.c in the MXit protocol plugin in     libpurple in Pidgin before 2.10.7 allows remote servers     to execute arbitrary code via a long HTTP header.
    (CVE-2013-0272)

  - sametime.c in the Sametime protocol plugin in libpurple     in Pidgin before 2.10.7 does not properly terminate long     user IDs, which allows remote servers to cause a denial     of service (application crash) via a crafted packet.
    (CVE-2013-0273)

  - upnp.c in libpurple in Pidgin before 2.10.7 does not     properly terminate long strings in UPnP responses, which     allows remote attackers to cause a denial of service     (application crash) by leveraging access to the local     network. (CVE-2013-0274)

  - Multiple integer signedness errors in libpurple in     Pidgin before 2.10.8 allow remote attackers to cause a     denial of service (application crash) via a crafted     timestamp value in an XMPP message. (CVE-2013-6477)

  - gtkimhtml.c in Pidgin before 2.10.8 does not properly     interact with underlying library support for wide Pango     layouts, which allows user-assisted remote attackers to     cause a denial of service (application crash) via a long     URL that is examined with a tooltip. (CVE-2013-6478)

  - util.c in libpurple in Pidgin before 2.10.8 does not     properly allocate memory for HTTP responses that are     inconsistent with the Content-Length header, which     allows remote HTTP servers to cause a denial of service     (application crash) via a crafted response.
    (CVE-2013-6479)

  - libpurple/protocols/yahoo/libymsg.c in Pidgin before     2.10.8 allows remote attackers to cause a denial of     service (crash) via a Yahoo! P2P message with a crafted     length field, which triggers a buffer over-read.
    (CVE-2013-6481)

  - Pidgin before 2.10.8 allows remote MSN servers to cause     a denial of service (NULL pointer dereference and crash)     via a crafted (1) SOAP response, (2) OIM XML response,     or (3) Content-Length header. (CVE-2013-6482)

  - The XMPP protocol plugin in libpurple in Pidgin before     2.10.8 does not properly determine whether the from     address in an iq reply is consistent with the to address     in an iq request, which allows remote attackers to spoof     iq traffic or cause a denial of service (NULL pointer     dereference and application crash) via a crafted reply.
    (CVE-2013-6483)

  - The STUN protocol implementation in libpurple in Pidgin     before 2.10.8 allows remote STUN servers to cause a     denial of service (out-of-bounds write operation and     application crash) by triggering a socket read error.
    (CVE-2013-6484)

  - Buffer overflow in util.c in libpurple in Pidgin before     2.10.8 allows remote HTTP servers to cause a denial of     service (application crash) or possibly have unspecified     other impact via an invalid chunk-size field in chunked     transfer-coding data. (CVE-2013-6485)

  - gtkutils.c in Pidgin before 2.10.8 on Windows allows     user-assisted remote attackers to execute arbitrary     programs via a message containing a file: URL that is     improperly handled during construction of an     explorer.exe command. NOTE: this vulnerability exists     because of an incomplete fix for CVE-2011-3185.
    (CVE-2013-6486)

  - Integer overflow in libpurple/protocols/gg/lib/http.c in     the Gadu-Gadu (gg) parser in Pidgin before 2.10.8 allows     remote attackers to have an unspecified impact via a     large Content-Length value, which triggers a buffer     overflow. (CVE-2013-6487)

  - Integer signedness error in the MXit functionality in     Pidgin before 2.10.8 allows remote attackers to cause a     denial of service (segmentation fault) via a crafted     emoticon value, which triggers an integer overflow and a     buffer overflow. (CVE-2013-6489)

  - The SIMPLE protocol functionality in Pidgin before     2.10.8 allows remote attackers to have an unspecified     impact via a negative Content-Length header, which     triggers a buffer overflow. (CVE-2013-6490)

  - The IRC protocol plugin in libpurple in Pidgin before     2.10.8 does not validate argument counts, which allows     remote IRC servers to cause a denial of service     (application crash) via a crafted message.
    (CVE-2014-0020)

A heap-based buffer overflow flaw was found in the way Pidgin processed certain HTTP responses. A malicious server could send a specially crafted HTTP response, causing Pidgin to crash or potentially execute arbitrary code with the permissions of the user running Pidgin. (CVE-2013-6485)

Multiple heap-based buffer overflow flaws were found in several protocol plug-ins in Pidgin (Gadu-Gadu, MXit, SIMPLE). A malicious server could send a specially crafted message, causing Pidgin to crash or potentially execute arbitrary code with the permissions of the user running Pidgin. (CVE-2013-6487, CVE-2013-6489, CVE-2013-6490)

Multiple denial of service flaws were found in several protocol plug-ins in Pidgin (Yahoo!, XMPP, MSN, stun, IRC). A remote attacker could use these flaws to crash Pidgin by sending a specially crafted message. (CVE-2012-6152, CVE-2013-6477, CVE-2013-6481, CVE-2013-6482, CVE-2013-6484, CVE-2014-0020)

It was found that the Pidgin XMPP protocol plug-in did not verify the origin of 'iq' replies. A remote attacker could use this flaw to spoof an 'iq' reply, which could lead to injection of fake data or cause Pidgin to crash via a NULL pointer dereference. (CVE-2013-6483)

A flaw was found in the way Pidgin parsed certain HTTP response headers. A remote attacker could use this flaw to crash Pidgin via a specially crafted HTTP response header. (CVE-2013-6479)

It was found that Pidgin crashed when a mouse pointer was hovered over a long URL. A remote attacker could use this flaw to crash Pidgin by sending a message containing a long URL string. (CVE-2013-6478)

Pidgin must be restarted for this update to take effect.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
72265	Slackware 13.0 / 13.1 / 13.37 / 14.0 / 14.1 / current : pidgin (SSA:2014-034-01)	Nessus	Slackware Local Security Checks	2014/2/4	2021/1/14	critical
72364	RHEL 5 / 6 : pidgin (RHSA-2014:0139)	Nessus	Red Hat Local Security Checks	2014/2/6	2025/3/20	critical
72439	Debian DSA-2859-1 : pidgin - several vulnerabilities	Nessus	Debian Local Security Checks	2014/2/12	2021/1/11	critical
75256	openSUSE Security Update : pidgin / pidgin-branding-openSUSE (openSUSE-SU-2014:0239-1)	Nessus	SuSE Local Security Checks	2014/6/13	2021/1/19	high
80740	Oracle Solaris Third-Party Patch Update : pidgin (multiple_vulnerabilities_in_pidgin2)	Nessus	Solaris Local Security Checks	2015/1/19	2021/1/14	critical
72365	Scientific Linux Security Update : pidgin on SL5.x, SL6.x i386/x86_64 (20140205)	Nessus	Scientific Linux Local Security Checks	2014/2/6	2021/1/14	critical

检测

插件搜索

critical

critical

critical

high

critical

critical