An update for pidgin is now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Pidgin is an instant messaging program which can log in to multiple accounts on multiple instant messaging networks simultaneously.

The following packages have been upgraded to a later upstream version:
pidgin (2.10.11). (BZ#1369526)

Security Fix(es) :

* A denial of service flaw was found in the way Pidgin's Mxit plug-in handled emoticons. A malicious remote server or a man-in-the-middle attacker could potentially use this flaw to crash Pidgin by sending a specially crafted emoticon. (CVE-2014-3695)

* A denial of service flaw was found in the way Pidgin parsed Groupwise server messages. A malicious remote server or a man-in-the-middle attacker could potentially use this flaw to cause Pidgin to consume an excessive amount of memory, possibly leading to a crash, by sending a specially crafted message. (CVE-2014-3696)

* An information disclosure flaw was discovered in the way Pidgin parsed XMPP messages. A malicious remote server or a man-in-the-middle attacker could potentially use this flaw to disclose a portion of memory belonging to the Pidgin process by sending a specially crafted XMPP message. (CVE-2014-3698)

* An out-of-bounds write flaw was found in the way Pidgin processed XML content. A malicious remote server could potentially use this flaw to crash Pidgin or execute arbitrary code in the context of the pidgin process. (CVE-2017-2640)

* It was found that Pidgin's SSL/TLS plug-ins had a flaw in the certificate validation functionality. An attacker could use this flaw to create a fake certificate, that Pidgin would trust, which could be used to conduct man-in-the-middle attacks against Pidgin.
(CVE-2014-3694)

Red Hat would like to thank the Pidgin project for reporting these issues. Upstream acknowledges Yves Younan (Cisco Talos) and Richard Johnson (Cisco Talos) as the original reporters of CVE-2014-3695 and CVE-2014-3696; Thijs Alkemade and Paul Aurich as the original reporters of CVE-2014-3698; and Jacob Appelbaum and Moxie Marlinspike as the original reporters of CVE-2014-3694.

Additional Changes :

For detailed information on changes in this release, see the Red Hat Enterprise Linux 7.4 Release Notes linked from the References section.

The version of Pidgin installed on the remote Windows host is prior to 2.12.0. It is, therefore, affected by a remote code execution vulnerability in the libpurple library in util.c due to an out-of-bounds writer error in the purple_markup_unescape_entity() function that is triggered when handling invalid XML entities separated by whitespaces. An unauthenticated, remote attacker can exploit this, via a malicious server, to execute arbitrary code.

The remote MiracleLinux 7 host has a package installed that is affected by multiple vulnerabilities as referenced in the AXSA:2017-1913:01 advisory.

    Pidgin allows you to talk to anyone using a variety of messaging     protocols including AIM, MSN, Yahoo!, Jabber, Bonjour, Gadu-Gadu,     ICQ, IRC, Novell Groupwise, QQ, Lotus Sametime, SILC, Simple and     Zephyr.  These protocols are implemented using a modular, easy to     use design.  To use a protocol, just add an account using the     account editor.
    Pidgin supports many common features of other clients, as well as many     unique features, such as perl scripting, TCL scripting and C plugins.
    Pidgin is not affiliated with or endorsed by America Online, Inc.,     Microsoft Corporation, Yahoo! Inc., or ICQ Inc.
    CVE-2014-3694     The (1) bundled GnuTLS SSL/TLS plugin and the (2) bundled OpenSSL     SSL/TLS plugin in libpurple in Pidgin before 2.10.10 do not properly     consider the Basic Constraints extension during verification of X.509     certificates from SSL servers, which allows man-in-the-middle     attackers to spoof servers and obtain sensitive information via a     crafted certificate.
    CVE-2014-3695     markup.c in the MXit protocol plugin in libpurple in Pidgin before     2.10.10 allows remote servers to cause a denial of service     (application crash) via a large length value in an emoticon response.
    CVE-2014-3696     nmevent.c in the Novell GroupWise protocol plugin in libpurple in     Pidgin before 2.10.10 allows remote servers to cause a denial of     service (application crash) via a crafted server message that triggers     a large memory allocation.
    CVE-2014-3698     The jabber_idn_validate function in jutil.c in the Jabber protocol     plugin in libpurple in Pidgin before 2.10.10 allows remote attackers     to obtain sensitive information from process memory via a crafted XMPP     message.
    CVE-2017-2640
    ** RESERVED **     This candidate has been reserved by an organization or individual that     will use it when announcing a new security problem.  When the     candidate has been publicized, the details for this candidate will be     provided.

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It was discovered that an invalid XML file can trigger an out-of-bound memory access in Pidgin, a multi-protocol instant messaging client, when it is sent by a malicious server. This might lead to a crash or, in some extreme cases, to remote code execution in the client-side.

For Debian 7 'Wheezy', these problems have been fixed in version 2.10.10-1~deb7u3.

We recommend that you upgrade your pidgin packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for pidgin fixes the following issues :

Feature update :

  - Update to GNOME 3.20.2 (fate#318572).

Security issues fixed :

  - CVE-2017-2640: Fix an out of bounds memory read in     purple_markup_unescape_entity. (boo#1028835)

  - CVE-2014-3698: remote information leak via crafted XMPP     message (boo#902408).

  - CVE-2014-3696: denial of service parsing Groupwise     server message (boo#902410).

  - CVE-2014-3695: crash in MXit protocol plug-in     (boo#902409).

Bugfixes

  - Correctly remove *.so files for plugins (fixes     devel-file-in-non-devel-package).

  - Remove generation of a plugin list to package, simply     add it all in %files with exclusions.

  - Build with GStreamer 1.x on SLE 12 SP2.

  - Fix SASL EXTERNAL fingerprint authentication     (boo#1009974).

  - Use ALSA as default for avoiding broken volume control     of pa sink (boo#886670).

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - An out-of-bounds write flaw was found in the way Pidgin before 2.12.0 processed XML content. A malicious     remote server could potentially use this flaw to crash Pidgin or execute arbitrary code in the context of     the pidgin process. (CVE-2017-2640)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote host is affected by the vulnerability described in GLSA-201706-10 (Pidgin: Arbitrary code execution)

    Joseph Bisch discovered that Pidgin incorrectly handled certain xml       messages.
  Impact :

    A remote attacker could send a specially crafted instant message,       possibly resulting in execution of arbitrary code with the privileges of       the Pidgin process.
  Workaround :

    There is no known workaround at this time.

It was discovered a vulnerability in Pidgin, a multi-protocol instant messaging client. A server controlled by an attacker can send an invalid XML that can trigger an out-of-bound memory access. This might lead to a crash or, in some extreme cases, to remote code execution in the client-side.

According to the versions of the pidgin package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - A denial of service flaw was found in the way Pidgin's     Mxit plug-in handled emoticons. A malicious remote     server or a man-in-the-middle attacker could     potentially use this flaw to crash Pidgin by sending a     specially crafted emoticon. (CVE-2014-3695)

  - A denial of service flaw was found in the way Pidgin     parsed Groupwise server messages. A malicious remote     server or a man-in-the-middle attacker could     potentially use this flaw to cause Pidgin to consume an     excessive amount of memory, possibly leading to a     crash, by sending a specially crafted message.
    (CVE-2014-3696)

  - An information disclosure flaw was discovered in the     way Pidgin parsed XMPP messages. A malicious remote     server or a man-in-the-middle attacker could     potentially use this flaw to disclose a portion of     memory belonging to the Pidgin process by sending a     specially crafted XMPP message. (CVE-2014-3698)

  - An out-of-bounds write flaw was found in the way Pidgin     processed XML content. A malicious remote server could     potentially use this flaw to crash Pidgin or execute     arbitrary code in the context of the pidgin process.
    (CVE-2017-2640)

  - It was found that Pidgin's SSL/TLS plug-ins had a flaw     in the certificate validation functionality. An     attacker could use this flaw to create a fake     certificate, that Pidgin would trust, which could be     used to conduct man-in-the-middle attacks against     Pidgin. (CVE-2014-3694)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The following packages have been upgraded to a later upstream version:
pidgin (2.10.11).

Security Fix(es) :

  - A denial of service flaw was found in the way Pidgin's     Mxit plug-in handled emoticons. A malicious remote     server or a man-in-the-middle attacker could potentially     use this flaw to crash Pidgin by sending a specially     crafted emoticon. (CVE-2014-3695)

  - A denial of service flaw was found in the way Pidgin     parsed Groupwise server messages. A malicious remote     server or a man-in-the-middle attacker could potentially     use this flaw to cause Pidgin to consume an excessive     amount of memory, possibly leading to a crash, by     sending a specially crafted message. (CVE-2014-3696)

  - An information disclosure flaw was discovered in the way     Pidgin parsed XMPP messages. A malicious remote server     or a man-in-the-middle attacker could potentially use     this flaw to disclose a portion of memory belonging to     the Pidgin process by sending a specially crafted XMPP     message. (CVE-2014-3698)

  - An out-of-bounds write flaw was found in the way Pidgin     processed XML content. A malicious remote server could     potentially use this flaw to crash Pidgin or execute     arbitrary code in the context of the pidgin process.
    (CVE-2017-2640)

  - It was found that Pidgin's SSL/TLS plug-ins had a flaw     in the certificate validation functionality. An attacker     could use this flaw to create a fake certificate, that     Pidgin would trust, which could be used to conduct     man-in-the-middle attacks against Pidgin.
    (CVE-2014-3694)

The remote Ubuntu 14.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-3231-1 advisory.

    Joseph Bisch discovered that Pidgin incorrectly handled certain xml messages. A remote attacker could use     this issue to cause Pidgin to crash, resulting in a denial of service, or possibly execute arbitrary code.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

New pidgin packages are available for Slackware 13.0, 13.1, 13.37, 14.0, 14.1, 14.2, and -current to fix a security issue.

The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2017-1854 advisory.

    - Add patch for CVE-2017-2640       Resolves: #1431022

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
102736	CentOS 7 : pidgin (CESA-2017:1854)	Nessus	CentOS Local Security Checks	2017/8/25	2021/1/4	critical
97947	Pidgin < 2.12.0 libpurple/util.c purple_markup_unescape_entity() XML Entity Handling RCE	Nessus	Windows	2017/3/24	2019/11/13	critical
289267	MiracleLinux 7 : pidgin-2.10.11-5.el7 (AXSA:2017-1913:01)	Nessus	Miracle Linux Local Security Checks	2026/1/16	2026/1/16	critical
97669	Debian DLA-853-1 : pidgin security update	Nessus	Debian Local Security Checks	2017/3/13	2025/12/30	critical
99194	openSUSE Security Update : pidgin (openSUSE-2017-431)	Nessus	SuSE Local Security Checks	2017/4/5	2025/12/26	critical
221079	Linux Distros Unpatched Vulnerability : CVE-2017-2640	Nessus	Misc.	2025/3/4	2025/9/3	critical
100653	GLSA-201706-10 : Pidgin: Arbitrary code execution	Nessus	Gentoo Local Security Checks	2017/6/7	2025/12/17	critical
97644	Debian DSA-3806-1 : pidgin - security update	Nessus	Debian Local Security Checks	2017/3/10	2025/12/30	critical
103004	EulerOS 2.0 SP2 : pidgin (EulerOS-SA-2017-1166)	Nessus	Huawei Local Security Checks	2017/9/8	2025/11/24	critical
102102	RHEL 7 : pidgin (RHSA-2017:1854)	Nessus	Red Hat Local Security Checks	2017/8/2	2025/12/4	critical
102651	Scientific Linux Security Update : pidgin on SL7.x x86_64 (20170801)	Nessus	Scientific Linux Local Security Checks	2017/8/22	2025/11/26	critical
97752	Ubuntu 14.04 LTS : Pidgin vulnerability (USN-3231-1)	Nessus	Ubuntu Local Security Checks	2017/3/15	2024/8/27	critical
97755	Slackware 13.0 / 13.1 / 13.37 / 14.0 / 14.1 / 14.2 / current : pidgin (SSA:2017-074-01)	Nessus	Slackware Local Security Checks	2017/3/16	2025/12/30	critical
102283	Oracle Linux 7 : pidgin (ELSA-2017-1854)	Nessus	Oracle Linux Local Security Checks	2017/8/9	2024/11/1	critical

检测

插件搜索

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical