An update for pidgin is now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Pidgin is an instant messaging program which can log in to multiple accounts on multiple instant messaging networks simultaneously.

The following packages have been upgraded to a later upstream version:
pidgin (2.10.11). (BZ#1369526)

Security Fix(es) :

* A denial of service flaw was found in the way Pidgin's Mxit plug-in handled emoticons. A malicious remote server or a man-in-the-middle attacker could potentially use this flaw to crash Pidgin by sending a specially crafted emoticon. (CVE-2014-3695)

* A denial of service flaw was found in the way Pidgin parsed Groupwise server messages. A malicious remote server or a man-in-the-middle attacker could potentially use this flaw to cause Pidgin to consume an excessive amount of memory, possibly leading to a crash, by sending a specially crafted message. (CVE-2014-3696)

* An information disclosure flaw was discovered in the way Pidgin parsed XMPP messages. A malicious remote server or a man-in-the-middle attacker could potentially use this flaw to disclose a portion of memory belonging to the Pidgin process by sending a specially crafted XMPP message. (CVE-2014-3698)

* An out-of-bounds write flaw was found in the way Pidgin processed XML content. A malicious remote server could potentially use this flaw to crash Pidgin or execute arbitrary code in the context of the pidgin process. (CVE-2017-2640)

* It was found that Pidgin's SSL/TLS plug-ins had a flaw in the certificate validation functionality. An attacker could use this flaw to create a fake certificate, that Pidgin would trust, which could be used to conduct man-in-the-middle attacks against Pidgin.
(CVE-2014-3694)

Red Hat would like to thank the Pidgin project for reporting these issues. Upstream acknowledges Yves Younan (Cisco Talos) and Richard Johnson (Cisco Talos) as the original reporters of CVE-2014-3695 and CVE-2014-3696; Thijs Alkemade and Paul Aurich as the original reporters of CVE-2014-3698; and Jacob Appelbaum and Moxie Marlinspike as the original reporters of CVE-2014-3694.

Additional Changes :

For detailed information on changes in this release, see the Red Hat Enterprise Linux 7.4 Release Notes linked from the References section.

According to the versions of the pidgin package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - A denial of service flaw was found in the way Pidgin's     Mxit plug-in handled emoticons. A malicious remote     server or a man-in-the-middle attacker could     potentially use this flaw to crash Pidgin by sending a     specially crafted emoticon. (CVE-2014-3695)

  - A denial of service flaw was found in the way Pidgin     parsed Groupwise server messages. A malicious remote     server or a man-in-the-middle attacker could     potentially use this flaw to cause Pidgin to consume an     excessive amount of memory, possibly leading to a     crash, by sending a specially crafted message.
    (CVE-2014-3696)

  - An information disclosure flaw was discovered in the     way Pidgin parsed XMPP messages. A malicious remote     server or a man-in-the-middle attacker could     potentially use this flaw to disclose a portion of     memory belonging to the Pidgin process by sending a     specially crafted XMPP message. (CVE-2014-3698)

  - An out-of-bounds write flaw was found in the way Pidgin     processed XML content. A malicious remote server could     potentially use this flaw to crash Pidgin or execute     arbitrary code in the context of the pidgin process.
    (CVE-2017-2640)

  - It was found that Pidgin's SSL/TLS plug-ins had a flaw     in the certificate validation functionality. An     attacker could use this flaw to create a fake     certificate, that Pidgin would trust, which could be     used to conduct man-in-the-middle attacks against     Pidgin. (CVE-2014-3694)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for pidgin fixes the following issues :

Feature update :

  - Update to GNOME 3.20.2 (fate#318572).

Security issues fixed :

  - CVE-2017-2640: Fix an out of bounds memory read in     purple_markup_unescape_entity. (boo#1028835)

Bugfixes

  - Correctly remove *.so files for plugins (fixes     devel-file-in-non-devel-package).

  - Remove generation of a plugin list to package, simply     add it all in %files with exclusions.

  - Fix SASL EXTERNAL fingerprint authentication     (boo#1009974).

This update for pidgin to version 2.12.0 fixes the following issues :

This security issue was fixed :

  - CVE-2017-2640: Out of bounds memory read in     purple_markup_unescape_entity (boo#1028835).

These non-security issues were fixed :

  + libpurple :

  - Fix the use of uninitialised memory if running     non-debug-enabled versions of glib.

  - Update AIM dev and dist ID's to new ones that were     assigned by AOL.

  - TLS certificate verification now uses SHA-256 checksums.

  - Fix the SASL external auth for Freenode (boo#1009974).

  - Remove the MSN protocol plugin. It has been unusable and     dormant for some time.

  - Remove the Mxit protocol plugin. The service was closed     at the end ofSeptember 2016.

  - Remove the MySpaceIM protocol plugin. The service has     been defunct for a long time (pidgin.im#15356).

  - Remove the Yahoo! protocol plugin. Yahoo has completely     reimplemented their protocol, so this version is no     longer operable as of August 5th, 2016.

  - Remove the Facebook (XMPP) account option. According to     https://developers.facebook.com/docs/chat the XMPP Chat     API service ended April 30th, 2015.

  - Fix gnutls certificate validation errors that mainly     affected Google.

  + General :

  - Replace instances of d.pidgin.im with     developer.pidgin.im and update the urls to use https     (pidgin.im#17036).

  + IRC :

  - Fix an issue of messages being silently cut off at 500     characters. Large messages are now split into parts and     sent one by one (pidgin.im#4753).

The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2017-1854 advisory.

    - Add patch for CVE-2017-2640       Resolves: #1431022

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

New pidgin packages are available for Slackware 13.0, 13.1, 13.37, 14.0, 14.1, 14.2, and -current to fix a security issue.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
102736	CentOS 7 : pidgin (CESA-2017:1854)	Nessus	CentOS Local Security Checks	2017/8/25	2021/1/4	critical
103003	EulerOS 2.0 SP1 : pidgin (EulerOS-SA-2017-1165)	Nessus	Huawei Local Security Checks	2017/9/8	2025/11/24	critical
99151	openSUSE Security Update : pidgin (openSUSE-2017-410)	Nessus	SuSE Local Security Checks	2017/4/3	2025/12/26	critical
99295	openSUSE Security Update : pidgin (openSUSE-2017-457)	Nessus	SuSE Local Security Checks	2017/4/12	2025/12/26	critical
102283	Oracle Linux 7 : pidgin (ELSA-2017-1854)	Nessus	Oracle Linux Local Security Checks	2017/8/9	2024/11/1	critical
97755	Slackware 13.0 / 13.1 / 13.37 / 14.0 / 14.1 / 14.2 / current : pidgin (SSA:2017-074-01)	Nessus	Slackware Local Security Checks	2017/3/16	2025/12/30	critical

检测

插件搜索

critical

critical

critical

critical

critical

critical