Synopsis: Moderate: pidgin security, bug fix, and enhancement
Advisory ID: SLSA-2017:1854-1
Issue Date: 2017-08-01
CVE Numbers: CVE-2014-3694
CVE-2014-3695
CVE-2014-3696
CVE-2014-3698
CVE-2017-2640
—
The following packages have been upgraded to a later upstream version:
pidgin (2.10.11).
Security Fix(es):
* A denial of service flaw was found in the way Pidgin’s Mxit plug-in
handled emoticons. A malicious remote server or a man-in-the-middle
attacker could potentially use this flaw to crash Pidgin by sending a
specially crafted emoticon. (CVE-2014-3695)
* A denial of service flaw was found in the way Pidgin parsed Groupwise
server messages. A malicious remote server or a man-in-the-middle attacker
could potentially use this flaw to cause Pidgin to consume an excessive
amount of memory, possibly leading to a crash, by sending a specially
crafted message. (CVE-2014-3696)
* An information disclosure flaw was discovered in the way Pidgin parsed
XMPP messages. A malicious remote server or a man-in-the-middle attacker
could potentially use this flaw to disclose a portion of memory belonging
to the Pidgin process by sending a specially crafted XMPP message.
(CVE-2014-3698)
* An out-of-bounds write flaw was found in the way Pidgin processed XML
content. A malicious remote server could potentially use this flaw to
crash Pidgin or execute arbitrary code in the context of the pidgin
process. (CVE-2017-2640)
* It was found that Pidgin’s SSL/TLS plug-ins had a flaw in the
certificate validation functionality. An attacker could use this flaw to
create a fake certificate, that Pidgin would trust, which could be used to
conduct man-in-the-middle attacks against Pidgin. (CVE-2014-3694)
—
SL7
x86_64
libpurple-2.10.11-5.el7.i686.rpm
libpurple-2.10.11-5.el7.x86_64.rpm
pidgin-2.10.11-5.el7.x86_64.rpm
pidgin-debuginfo-2.10.11-5.el7.i686.rpm
pidgin-debuginfo-2.10.11-5.el7.x86_64.rpm
finch-2.10.11-5.el7.i686.rpm
finch-2.10.11-5.el7.x86_64.rpm
finch-devel-2.10.11-5.el7.i686.rpm
finch-devel-2.10.11-5.el7.x86_64.rpm
libpurple-devel-2.10.11-5.el7.i686.rpm
libpurple-devel-2.10.11-5.el7.x86_64.rpm
libpurple-perl-2.10.11-5.el7.x86_64.rpm
libpurple-tcl-2.10.11-5.el7.x86_64.rpm
pidgin-devel-2.10.11-5.el7.i686.rpm
pidgin-devel-2.10.11-5.el7.x86_64.rpm
pidgin-perl-2.10.11-5.el7.x86_64.rpm
– Scientific Linux Development Team
