ID CVE-2017-2640
Summary An out-of-bounds write flaw was found in the way Pidgin before 2.12.0 processed XML content. A malicious remote server could potentially use this flaw to crash Pidgin or execute arbitrary code in the context of the pidgin process.
References
Vulnerable Configurations
  • Pidgin
    cpe:2.3:a:pidgin:pidgin
  • Pidgin 2.0.0
    cpe:2.3:a:pidgin:pidgin:2.0.0
  • Pidgin 2.0.1
    cpe:2.3:a:pidgin:pidgin:2.0.1
  • Pidgin 2.0.2
    cpe:2.3:a:pidgin:pidgin:2.0.2
  • Pidgin 2.1.0
    cpe:2.3:a:pidgin:pidgin:2.1.0
  • Pidgin 2.1.1
    cpe:2.3:a:pidgin:pidgin:2.1.1
  • Pidgin 2.2.0
    cpe:2.3:a:pidgin:pidgin:2.2.0
  • Pidgin 2.2.1
    cpe:2.3:a:pidgin:pidgin:2.2.1
  • Pidgin 2.2.2
    cpe:2.3:a:pidgin:pidgin:2.2.2
  • Pidgin 2.3.0
    cpe:2.3:a:pidgin:pidgin:2.3.0
  • Pidgin 2.3.1
    cpe:2.3:a:pidgin:pidgin:2.3.1
  • Pidgin 2.4.0
    cpe:2.3:a:pidgin:pidgin:2.4.0
  • Pidgin 2.4.1
    cpe:2.3:a:pidgin:pidgin:2.4.1
  • Pidgin 2.4.2
    cpe:2.3:a:pidgin:pidgin:2.4.2
  • Pidgin 2.4.3
    cpe:2.3:a:pidgin:pidgin:2.4.3
  • Pidgin 2.5.0
    cpe:2.3:a:pidgin:pidgin:2.5.0
  • Pidgin 2.5.1
    cpe:2.3:a:pidgin:pidgin:2.5.1
  • Pidgin 2.5.2
    cpe:2.3:a:pidgin:pidgin:2.5.2
  • Pidgin 2.5.3
    cpe:2.3:a:pidgin:pidgin:2.5.3
  • Pidgin 2.5.4
    cpe:2.3:a:pidgin:pidgin:2.5.4
  • Pidgin 2.5.5
    cpe:2.3:a:pidgin:pidgin:2.5.5
  • Pidgin 2.5.6
    cpe:2.3:a:pidgin:pidgin:2.5.6
  • Pidgin 2.5.6
    cpe:2.3:a:pidgin:pidgin:2.5.7
  • Pidgin 2.5.8
    cpe:2.3:a:pidgin:pidgin:2.5.8
  • Pidgin 2.5.9
    cpe:2.3:a:pidgin:pidgin:2.5.9
  • Pidgin 2.6.0
    cpe:2.3:a:pidgin:pidgin:2.6.0
  • Pidgin 2.6.1
    cpe:2.3:a:pidgin:pidgin:2.6.1
  • Pidgin 2.6.2
    cpe:2.3:a:pidgin:pidgin:2.6.2
  • Pidgin 2.6.4
    cpe:2.3:a:pidgin:pidgin:2.6.4
  • Pidgin 2.6.5
    cpe:2.3:a:pidgin:pidgin:2.6.5
  • Pidgin 2.6.6
    cpe:2.3:a:pidgin:pidgin:2.6.6
  • Pidgin 2.7.0
    cpe:2.3:a:pidgin:pidgin:2.7.0
  • Pidgin 2.7.1
    cpe:2.3:a:pidgin:pidgin:2.7.1
  • Pidgin 2.7.2
    cpe:2.3:a:pidgin:pidgin:2.7.2
  • Pidgin 2.7.3
    cpe:2.3:a:pidgin:pidgin:2.7.3
  • Pidgin 2.7.4
    cpe:2.3:a:pidgin:pidgin:2.7.4
  • Pidgin 2.7.5
    cpe:2.3:a:pidgin:pidgin:2.7.5
  • Pidgin 2.7.6
    cpe:2.3:a:pidgin:pidgin:2.7.6
  • Pidgin 2.7.7
    cpe:2.3:a:pidgin:pidgin:2.7.7
  • Pidgin 2.7.8
    cpe:2.3:a:pidgin:pidgin:2.7.8
  • Pidgin 2.7.9
    cpe:2.3:a:pidgin:pidgin:2.7.9
  • Pidgin 2.7.10
    cpe:2.3:a:pidgin:pidgin:2.7.10
  • Pidgin 2.7.11
    cpe:2.3:a:pidgin:pidgin:2.7.11
  • Pidgin 2.8.0
    cpe:2.3:a:pidgin:pidgin:2.8.0
  • Pidgin 2.9.0
    cpe:2.3:a:pidgin:pidgin:2.9.0
  • Pidgin 2.10.0
    cpe:2.3:a:pidgin:pidgin:2.10.0
  • Pidgin 2.10.1
    cpe:2.3:a:pidgin:pidgin:2.10.1
  • Pidgin 2.10.2
    cpe:2.3:a:pidgin:pidgin:2.10.2
  • Pidgin 2.10.3
    cpe:2.3:a:pidgin:pidgin:2.10.3
  • Pidgin 2.10.4
    cpe:2.3:a:pidgin:pidgin:2.10.4
  • Pidgin 2.10.5
    cpe:2.3:a:pidgin:pidgin:2.10.5
  • Pidgin 2.10.6
    cpe:2.3:a:pidgin:pidgin:2.10.6
  • Pidgin 2.10.7
    cpe:2.3:a:pidgin:pidgin:2.10.7
  • Pidgin 2.10.8
    cpe:2.3:a:pidgin:pidgin:2.10.8
  • Pidgin 2.10.9
    cpe:2.3:a:pidgin:pidgin:2.10.9
  • Debian Linux 8.0 (Jessie)
    cpe:2.3:o:debian:debian_linux:8.0
  • RedHat Enterprise Linux Desktop 7.0
    cpe:2.3:o:redhat:enterprise_linux_desktop:7.0
  • RedHat Enterprise Linux Server 7.0
    cpe:2.3:o:redhat:enterprise_linux_server:7.0
  • Red Hat Enterprise Linux Server Advanced mission critical Update Support (AUS) 7.4
    cpe:2.3:o:redhat:enterprise_linux_server_aus:7.4
  • Red Hat Enterprise Linux Server Extended Update Support (EUS) 7.4
    cpe:2.3:o:redhat:enterprise_linux_server_eus:7.4
  • Red Hat Enterprise Linux Server Extended Update Support (EUS) 7.5
    cpe:2.3:o:redhat:enterprise_linux_server_eus:7.5
  • RedHat Enterprise Linux Workstation 7.0
    cpe:2.3:o:redhat:enterprise_linux_workstation:7.0
CVSS
Base: 7.5
Impact:
Exploitability:
CWE CWE-787
CAPEC
nessus via4
  • NASL family Debian Local Security Checks
    NASL id DEBIAN_DSA-3806.NASL
    description It was discovered a vulnerability in Pidgin, a multi-protocol instant messaging client. A server controlled by an attacker can send an invalid XML that can trigger an out-of-bound memory access. This might lead to a crash or, in some extreme cases, to remote code execution in the client-side.
    last seen 2019-02-21
    modified 2018-11-10
    plugin id 97644
    published 2017-03-10
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=97644
    title Debian DSA-3806-1 : pidgin - security update
  • NASL family Huawei Local Security Checks
    NASL id EULEROS_SA-2017-1166.NASL
    description According to the versions of the pidgin package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - A denial of service flaw was found in the way Pidgin's Mxit plug-in handled emoticons. A malicious remote server or a man-in-the-middle attacker could potentially use this flaw to crash Pidgin by sending a specially crafted emoticon. (CVE-2014-3695) - A denial of service flaw was found in the way Pidgin parsed Groupwise server messages. A malicious remote server or a man-in-the-middle attacker could potentially use this flaw to cause Pidgin to consume an excessive amount of memory, possibly leading to a crash, by sending a specially crafted message. (CVE-2014-3696) - An information disclosure flaw was discovered in the way Pidgin parsed XMPP messages. A malicious remote server or a man-in-the-middle attacker could potentially use this flaw to disclose a portion of memory belonging to the Pidgin process by sending a specially crafted XMPP message. (CVE-2014-3698) - An out-of-bounds write flaw was found in the way Pidgin processed XML content. A malicious remote server could potentially use this flaw to crash Pidgin or execute arbitrary code in the context of the pidgin process. (CVE-2017-2640) - It was found that Pidgin's SSL/TLS plug-ins had a flaw in the certificate validation functionality. An attacker could use this flaw to create a fake certificate, that Pidgin would trust, which could be used to conduct man-in-the-middle attacks against Pidgin. (CVE-2014-3694) Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen 2019-02-21
    modified 2018-12-05
    plugin id 103004
    published 2017-09-08
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=103004
    title EulerOS 2.0 SP2 : pidgin (EulerOS-SA-2017-1166)
  • NASL family Slackware Local Security Checks
    NASL id SLACKWARE_SSA_2017-074-01.NASL
    description New pidgin packages are available for Slackware 13.0, 13.1, 13.37, 14.0, 14.1, 14.2, and -current to fix a security issue.
    last seen 2019-02-21
    modified 2018-09-25
    plugin id 97755
    published 2017-03-16
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=97755
    title Slackware 13.0 / 13.1 / 13.37 / 14.0 / 14.1 / 14.2 / current : pidgin (SSA:2017-074-01)
  • NASL family Debian Local Security Checks
    NASL id DEBIAN_DLA-853.NASL
    description It was discovered that an invalid XML file can trigger an out-of-bound memory access in Pidgin, a multi-protocol instant messaging client, when it is sent by a malicious server. This might lead to a crash or, in some extreme cases, to remote code execution in the client-side. For Debian 7 'Wheezy', these problems have been fixed in version 2.10.10-1~deb7u3. We recommend that you upgrade your pidgin packages. NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen 2019-02-21
    modified 2018-09-25
    plugin id 97669
    published 2017-03-13
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=97669
    title Debian DLA-853-1 : pidgin security update
  • NASL family Gentoo Local Security Checks
    NASL id GENTOO_GLSA-201706-10.NASL
    description The remote host is affected by the vulnerability described in GLSA-201706-10 (Pidgin: Arbitrary code execution) Joseph Bisch discovered that Pidgin incorrectly handled certain xml messages. Impact : A remote attacker could send a specially crafted instant message, possibly resulting in execution of arbitrary code with the privileges of the Pidgin process. Workaround : There is no known workaround at this time.
    last seen 2019-02-21
    modified 2018-09-25
    plugin id 100653
    published 2017-06-07
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=100653
    title GLSA-201706-10 : Pidgin: Arbitrary code execution
  • NASL family Ubuntu Local Security Checks
    NASL id UBUNTU_USN-3231-1.NASL
    description Joseph Bisch discovered that Pidgin incorrectly handled certain xml messages. A remote attacker could use this issue to cause Pidgin to crash, resulting in a denial of service, or possibly execute arbitrary code. Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen 2019-02-21
    modified 2018-12-01
    plugin id 97752
    published 2017-03-15
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=97752
    title Ubuntu 12.04 LTS / 14.04 LTS : pidgin vulnerability (USN-3231-1)
  • NASL family SuSE Local Security Checks
    NASL id OPENSUSE-2017-457.NASL
    description This update for pidgin to version 2.12.0 fixes the following issues : This security issue was fixed : - CVE-2017-2640: Out of bounds memory read in purple_markup_unescape_entity (boo#1028835). These non-security issues were fixed : + libpurple : - Fix the use of uninitialised memory if running non-debug-enabled versions of glib. - Update AIM dev and dist ID's to new ones that were assigned by AOL. - TLS certificate verification now uses SHA-256 checksums. - Fix the SASL external auth for Freenode (boo#1009974). - Remove the MSN protocol plugin. It has been unusable and dormant for some time. - Remove the Mxit protocol plugin. The service was closed at the end ofSeptember 2016. - Remove the MySpaceIM protocol plugin. The service has been defunct for a long time (pidgin.im#15356). - Remove the Yahoo! protocol plugin. Yahoo has completely reimplemented their protocol, so this version is no longer operable as of August 5th, 2016. - Remove the Facebook (XMPP) account option. According to https://developers.facebook.com/docs/chat the XMPP Chat API service ended April 30th, 2015. - Fix gnutls certificate validation errors that mainly affected Google. + General : - Replace instances of d.pidgin.im with developer.pidgin.im and update the urls to use https (pidgin.im#17036). + IRC : - Fix an issue of messages being silently cut off at 500 characters. Large messages are now split into parts and sent one by one (pidgin.im#4753).
    last seen 2019-02-21
    modified 2018-09-25
    plugin id 99295
    published 2017-04-12
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=99295
    title openSUSE Security Update : pidgin (openSUSE-2017-457)
  • NASL family Red Hat Local Security Checks
    NASL id REDHAT-RHSA-2017-1854.NASL
    description An update for pidgin is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. Pidgin is an instant messaging program which can log in to multiple accounts on multiple instant messaging networks simultaneously. The following packages have been upgraded to a later upstream version: pidgin (2.10.11). (BZ#1369526) Security Fix(es) : * A denial of service flaw was found in the way Pidgin's Mxit plug-in handled emoticons. A malicious remote server or a man-in-the-middle attacker could potentially use this flaw to crash Pidgin by sending a specially crafted emoticon. (CVE-2014-3695) * A denial of service flaw was found in the way Pidgin parsed Groupwise server messages. A malicious remote server or a man-in-the-middle attacker could potentially use this flaw to cause Pidgin to consume an excessive amount of memory, possibly leading to a crash, by sending a specially crafted message. (CVE-2014-3696) * An information disclosure flaw was discovered in the way Pidgin parsed XMPP messages. A malicious remote server or a man-in-the-middle attacker could potentially use this flaw to disclose a portion of memory belonging to the Pidgin process by sending a specially crafted XMPP message. (CVE-2014-3698) * An out-of-bounds write flaw was found in the way Pidgin processed XML content. A malicious remote server could potentially use this flaw to crash Pidgin or execute arbitrary code in the context of the pidgin process. (CVE-2017-2640) * It was found that Pidgin's SSL/TLS plug-ins had a flaw in the certificate validation functionality. An attacker could use this flaw to create a fake certificate, that Pidgin would trust, which could be used to conduct man-in-the-middle attacks against Pidgin. (CVE-2014-3694) Red Hat would like to thank the Pidgin project for reporting these issues. Upstream acknowledges Yves Younan (Cisco Talos) and Richard Johnson (Cisco Talos) as the original reporters of CVE-2014-3695 and CVE-2014-3696; Thijs Alkemade and Paul Aurich as the original reporters of CVE-2014-3698; and Jacob Appelbaum and Moxie Marlinspike as the original reporters of CVE-2014-3694. Additional Changes : For detailed information on changes in this release, see the Red Hat Enterprise Linux 7.4 Release Notes linked from the References section.
    last seen 2019-02-21
    modified 2018-11-26
    plugin id 102102
    published 2017-08-02
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=102102
    title RHEL 7 : pidgin (RHSA-2017:1854)
  • NASL family SuSE Local Security Checks
    NASL id OPENSUSE-2017-410.NASL
    description This update for pidgin fixes the following issues : Feature update : - Update to GNOME 3.20.2 (fate#318572). Security issues fixed : - CVE-2017-2640: Fix an out of bounds memory read in purple_markup_unescape_entity. (boo#1028835) Bugfixes - Correctly remove *.so files for plugins (fixes devel-file-in-non-devel-package). - Remove generation of a plugin list to package, simply add it all in %files with exclusions. - Fix SASL EXTERNAL fingerprint authentication (boo#1009974).
    last seen 2019-02-21
    modified 2018-12-18
    plugin id 99151
    published 2017-04-03
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=99151
    title openSUSE Security Update : pidgin (openSUSE-2017-410)
  • NASL family Windows
    NASL id PIDGIN_2_12_0.NASL
    description The version of Pidgin installed on the remote Windows host is prior to 2.12.0. It is, therefore, affected by a remote code execution vulnerability in the libpurple library in util.c due to an out-of-bounds writer error in the purple_markup_unescape_entity() function that is triggered when handling invalid XML entities separated by whitespaces. An unauthenticated, remote attacker can exploit this, via a malicious server, to execute arbitrary code.
    last seen 2019-02-21
    modified 2018-07-24
    plugin id 97947
    published 2017-03-24
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=97947
    title Pidgin < 2.12.0 libpurple/util.c purple_markup_unescape_entity() XML Entity Handling RCE
  • NASL family CentOS Local Security Checks
    NASL id CENTOS_RHSA-2017-1854.NASL
    description An update for pidgin is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. Pidgin is an instant messaging program which can log in to multiple accounts on multiple instant messaging networks simultaneously. The following packages have been upgraded to a later upstream version: pidgin (2.10.11). (BZ#1369526) Security Fix(es) : * A denial of service flaw was found in the way Pidgin's Mxit plug-in handled emoticons. A malicious remote server or a man-in-the-middle attacker could potentially use this flaw to crash Pidgin by sending a specially crafted emoticon. (CVE-2014-3695) * A denial of service flaw was found in the way Pidgin parsed Groupwise server messages. A malicious remote server or a man-in-the-middle attacker could potentially use this flaw to cause Pidgin to consume an excessive amount of memory, possibly leading to a crash, by sending a specially crafted message. (CVE-2014-3696) * An information disclosure flaw was discovered in the way Pidgin parsed XMPP messages. A malicious remote server or a man-in-the-middle attacker could potentially use this flaw to disclose a portion of memory belonging to the Pidgin process by sending a specially crafted XMPP message. (CVE-2014-3698) * An out-of-bounds write flaw was found in the way Pidgin processed XML content. A malicious remote server could potentially use this flaw to crash Pidgin or execute arbitrary code in the context of the pidgin process. (CVE-2017-2640) * It was found that Pidgin's SSL/TLS plug-ins had a flaw in the certificate validation functionality. An attacker could use this flaw to create a fake certificate, that Pidgin would trust, which could be used to conduct man-in-the-middle attacks against Pidgin. (CVE-2014-3694) Red Hat would like to thank the Pidgin project for reporting these issues. Upstream acknowledges Yves Younan (Cisco Talos) and Richard Johnson (Cisco Talos) as the original reporters of CVE-2014-3695 and CVE-2014-3696; Thijs Alkemade and Paul Aurich as the original reporters of CVE-2014-3698; and Jacob Appelbaum and Moxie Marlinspike as the original reporters of CVE-2014-3694. Additional Changes : For detailed information on changes in this release, see the Red Hat Enterprise Linux 7.4 Release Notes linked from the References section.
    last seen 2019-02-21
    modified 2018-11-10
    plugin id 102736
    published 2017-08-25
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=102736
    title CentOS 7 : pidgin (CESA-2017:1854)
  • NASL family Scientific Linux Local Security Checks
    NASL id SL_20170801_PIDGIN_ON_SL7_X.NASL
    description The following packages have been upgraded to a later upstream version: pidgin (2.10.11). Security Fix(es) : - A denial of service flaw was found in the way Pidgin's Mxit plug-in handled emoticons. A malicious remote server or a man-in-the-middle attacker could potentially use this flaw to crash Pidgin by sending a specially crafted emoticon. (CVE-2014-3695) - A denial of service flaw was found in the way Pidgin parsed Groupwise server messages. A malicious remote server or a man-in-the-middle attacker could potentially use this flaw to cause Pidgin to consume an excessive amount of memory, possibly leading to a crash, by sending a specially crafted message. (CVE-2014-3696) - An information disclosure flaw was discovered in the way Pidgin parsed XMPP messages. A malicious remote server or a man-in-the-middle attacker could potentially use this flaw to disclose a portion of memory belonging to the Pidgin process by sending a specially crafted XMPP message. (CVE-2014-3698) - An out-of-bounds write flaw was found in the way Pidgin processed XML content. A malicious remote server could potentially use this flaw to crash Pidgin or execute arbitrary code in the context of the pidgin process. (CVE-2017-2640) - It was found that Pidgin's SSL/TLS plug-ins had a flaw in the certificate validation functionality. An attacker could use this flaw to create a fake certificate, that Pidgin would trust, which could be used to conduct man-in-the-middle attacks against Pidgin. (CVE-2014-3694)
    last seen 2019-02-21
    modified 2018-12-27
    plugin id 102651
    published 2017-08-22
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=102651
    title Scientific Linux Security Update : pidgin on SL7.x x86_64
  • NASL family Huawei Local Security Checks
    NASL id EULEROS_SA-2017-1165.NASL
    description According to the versions of the pidgin package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - A denial of service flaw was found in the way Pidgin's Mxit plug-in handled emoticons. A malicious remote server or a man-in-the-middle attacker could potentially use this flaw to crash Pidgin by sending a specially crafted emoticon. (CVE-2014-3695) - A denial of service flaw was found in the way Pidgin parsed Groupwise server messages. A malicious remote server or a man-in-the-middle attacker could potentially use this flaw to cause Pidgin to consume an excessive amount of memory, possibly leading to a crash, by sending a specially crafted message. (CVE-2014-3696) - An information disclosure flaw was discovered in the way Pidgin parsed XMPP messages. A malicious remote server or a man-in-the-middle attacker could potentially use this flaw to disclose a portion of memory belonging to the Pidgin process by sending a specially crafted XMPP message. (CVE-2014-3698) - An out-of-bounds write flaw was found in the way Pidgin processed XML content. A malicious remote server could potentially use this flaw to crash Pidgin or execute arbitrary code in the context of the pidgin process. (CVE-2017-2640) - It was found that Pidgin's SSL/TLS plug-ins had a flaw in the certificate validation functionality. An attacker could use this flaw to create a fake certificate, that Pidgin would trust, which could be used to conduct man-in-the-middle attacks against Pidgin. (CVE-2014-3694) Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen 2019-02-21
    modified 2018-12-05
    plugin id 103003
    published 2017-09-08
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=103003
    title EulerOS 2.0 SP1 : pidgin (EulerOS-SA-2017-1165)
  • NASL family SuSE Local Security Checks
    NASL id OPENSUSE-2017-431.NASL
    description This update for pidgin fixes the following issues : Feature update : - Update to GNOME 3.20.2 (fate#318572). Security issues fixed : - CVE-2017-2640: Fix an out of bounds memory read in purple_markup_unescape_entity. (boo#1028835) - CVE-2014-3698: remote information leak via crafted XMPP message (boo#902408). - CVE-2014-3696: denial of service parsing Groupwise server message (boo#902410). - CVE-2014-3695: crash in MXit protocol plug-in (boo#902409). Bugfixes - Correctly remove *.so files for plugins (fixes devel-file-in-non-devel-package). - Remove generation of a plugin list to package, simply add it all in %files with exclusions. - Build with GStreamer 1.x on SLE 12 SP2. - Fix SASL EXTERNAL fingerprint authentication (boo#1009974). - Use ALSA as default for avoiding broken volume control of pa sink (boo#886670).
    last seen 2019-02-21
    modified 2018-12-18
    plugin id 99194
    published 2017-04-05
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=99194
    title openSUSE Security Update : pidgin (openSUSE-2017-431)
  • NASL family Oracle Linux Local Security Checks
    NASL id ORACLELINUX_ELSA-2017-1854.NASL
    description From Red Hat Security Advisory 2017:1854 : An update for pidgin is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. Pidgin is an instant messaging program which can log in to multiple accounts on multiple instant messaging networks simultaneously. The following packages have been upgraded to a later upstream version: pidgin (2.10.11). (BZ#1369526) Security Fix(es) : * A denial of service flaw was found in the way Pidgin's Mxit plug-in handled emoticons. A malicious remote server or a man-in-the-middle attacker could potentially use this flaw to crash Pidgin by sending a specially crafted emoticon. (CVE-2014-3695) * A denial of service flaw was found in the way Pidgin parsed Groupwise server messages. A malicious remote server or a man-in-the-middle attacker could potentially use this flaw to cause Pidgin to consume an excessive amount of memory, possibly leading to a crash, by sending a specially crafted message. (CVE-2014-3696) * An information disclosure flaw was discovered in the way Pidgin parsed XMPP messages. A malicious remote server or a man-in-the-middle attacker could potentially use this flaw to disclose a portion of memory belonging to the Pidgin process by sending a specially crafted XMPP message. (CVE-2014-3698) * An out-of-bounds write flaw was found in the way Pidgin processed XML content. A malicious remote server could potentially use this flaw to crash Pidgin or execute arbitrary code in the context of the pidgin process. (CVE-2017-2640) * It was found that Pidgin's SSL/TLS plug-ins had a flaw in the certificate validation functionality. An attacker could use this flaw to create a fake certificate, that Pidgin would trust, which could be used to conduct man-in-the-middle attacks against Pidgin. (CVE-2014-3694) Red Hat would like to thank the Pidgin project for reporting these issues. Upstream acknowledges Yves Younan (Cisco Talos) and Richard Johnson (Cisco Talos) as the original reporters of CVE-2014-3695 and CVE-2014-3696; Thijs Alkemade and Paul Aurich as the original reporters of CVE-2014-3698; and Jacob Appelbaum and Moxie Marlinspike as the original reporters of CVE-2014-3694. Additional Changes : For detailed information on changes in this release, see the Red Hat Enterprise Linux 7.4 Release Notes linked from the References section.
    last seen 2019-02-21
    modified 2018-09-25
    plugin id 102283
    published 2017-08-09
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=102283
    title Oracle Linux 7 : pidgin (ELSA-2017-1854)
redhat via4
advisories
bugzilla
id 1446368
title Silence -Wsign-compare
oval
AND
  • OR
    • comment Red Hat Enterprise Linux 7 Client is installed
      oval oval:com.redhat.rhsa:tst:20140675001
    • comment Red Hat Enterprise Linux 7 Server is installed
      oval oval:com.redhat.rhsa:tst:20140675002
    • comment Red Hat Enterprise Linux 7 Workstation is installed
      oval oval:com.redhat.rhsa:tst:20140675003
    • comment Red Hat Enterprise Linux 7 ComputeNode is installed
      oval oval:com.redhat.rhsa:tst:20140675004
  • OR
    • AND
      • comment finch is earlier than 0:2.10.11-5.el7
        oval oval:com.redhat.rhsa:tst:20171854017
      • comment finch is signed with Red Hat redhatrelease2 key
        oval oval:com.redhat.rhsa:tst:20100890020
    • AND
      • comment finch-devel is earlier than 0:2.10.11-5.el7
        oval oval:com.redhat.rhsa:tst:20171854019
      • comment finch-devel is signed with Red Hat redhatrelease2 key
        oval oval:com.redhat.rhsa:tst:20100890012
    • AND
      • comment libpurple is earlier than 0:2.10.11-5.el7
        oval oval:com.redhat.rhsa:tst:20171854007
      • comment libpurple is signed with Red Hat redhatrelease2 key
        oval oval:com.redhat.rhsa:tst:20100890008
    • AND
      • comment libpurple-devel is earlier than 0:2.10.11-5.el7
        oval oval:com.redhat.rhsa:tst:20171854015
      • comment libpurple-devel is signed with Red Hat redhatrelease2 key
        oval oval:com.redhat.rhsa:tst:20100890016
    • AND
      • comment libpurple-perl is earlier than 0:2.10.11-5.el7
        oval oval:com.redhat.rhsa:tst:20171854009
      • comment libpurple-perl is signed with Red Hat redhatrelease2 key
        oval oval:com.redhat.rhsa:tst:20100890014
    • AND
      • comment libpurple-tcl is earlier than 0:2.10.11-5.el7
        oval oval:com.redhat.rhsa:tst:20171854021
      • comment libpurple-tcl is signed with Red Hat redhatrelease2 key
        oval oval:com.redhat.rhsa:tst:20100890022
    • AND
      • comment pidgin is earlier than 0:2.10.11-5.el7
        oval oval:com.redhat.rhsa:tst:20171854013
      • comment pidgin is signed with Red Hat redhatrelease2 key
        oval oval:com.redhat.rhsa:tst:20100890006
    • AND
      • comment pidgin-devel is earlier than 0:2.10.11-5.el7
        oval oval:com.redhat.rhsa:tst:20171854005
      • comment pidgin-devel is signed with Red Hat redhatrelease2 key
        oval oval:com.redhat.rhsa:tst:20100890018
    • AND
      • comment pidgin-perl is earlier than 0:2.10.11-5.el7
        oval oval:com.redhat.rhsa:tst:20171854011
      • comment pidgin-perl is signed with Red Hat redhatrelease2 key
        oval oval:com.redhat.rhsa:tst:20100890010
rhsa
id RHSA-2017:1854
released 2017-08-01
severity Moderate
title RHSA-2017:1854: pidgin security, bug fix, and enhancement update (Moderate)
rpms
  • finch-0:2.10.11-5.el7
  • finch-devel-0:2.10.11-5.el7
  • libpurple-0:2.10.11-5.el7
  • libpurple-devel-0:2.10.11-5.el7
  • libpurple-perl-0:2.10.11-5.el7
  • libpurple-tcl-0:2.10.11-5.el7
  • pidgin-0:2.10.11-5.el7
  • pidgin-devel-0:2.10.11-5.el7
  • pidgin-perl-0:2.10.11-5.el7
refmap via4
bid 96775
confirm https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-2640
debian DSA-3806
gentoo GLSA-201706-10
Last major update 27-07-2018 - 14:29
Published 27-07-2018 - 14:29
Last modified 24-09-2018 - 15:54
Back to Top