pidgin vulnerabilities

9 July 2012

pidgin vulnerabilities

A security issue affects these releases of Ubuntu and its derivatives:

• Ubuntu 12.04 LTS
• Ubuntu 11.10
• Ubuntu 11.04
• Ubuntu 10.04 LTS

Summary

Several security issues were fixed in Pidgin.

Software Description

• pidgin - graphical multi-protocol instant messaging client for X

Details

Evgeny Boger discovered that Pidgin incorrectly handled buddy list messages in the AIM and ICQ protocol handlers. A remote attacker could send a specially crafted message and cause Pidgin to crash, leading to a denial of service. This issue only affected Ubuntu 10.04 LTS, 11.04 and 11.10. (CVE-2011-4601)

Thijs Alkemade discovered that Pidgin incorrectly handled malformed voice and video chat requests in the XMPP protocol handler. A remote attacker could send a specially crafted message and cause Pidgin to crash, leading to a denial of service. This issue only affected Ubuntu 10.04 LTS, 11.04 and 11.10. (CVE-2011-4602)

Diego Bauche Madero discovered that Pidgin incorrectly handled UTF-8 sequences in the SILC protocol handler. A remote attacker could send a specially crafted message and cause Pidgin to crash, leading to a denial of service. This issue only affected Ubuntu 10.04 LTS, 11.04 and 11.10. (CVE-2011-4603)

Julia Lawall discovered that Pidgin incorrectly cleared memory contents used in cryptographic operations. An attacker could exploit this to read the memory contents, leading to an information disclosure. This issue only affected Ubuntu 10.04 LTS. (CVE-2011-4922)

Clemens Huebner and Kevin Stange discovered that Pidgin incorrectly handled nickname changes inside chat rooms in the XMPP protocol handler. A remote attacker could exploit this by changing nicknames, leading to a denial of service. This issue only affected Ubuntu 11.10. (CVE-2011-4939)

Thijs Alkemade discovered that Pidgin incorrectly handled off-line instant messages in the MSN protocol handler. A remote attacker could send a specially crafted message and cause Pidgin to crash, leading to a denial of service. This issue only affected Ubuntu 10.04 LTS, 11.04 and 11.10. (CVE-2012-1178)

José Valentín Gutiérrez discovered that Pidgin incorrectly handled SOCKS5 proxy connections during file transfer requests in the XMPP protocol handler. A remote attacker could send a specially crafted request and cause Pidgin to crash, leading to a denial of service. This issue only affected Ubuntu 12.04 LTS and 11.10. (CVE-2012-2214)

Fabian Yamaguchi discovered that Pidgin incorrectly handled malformed messages in the MSN protocol handler. A remote attacker could send a specially crafted message and cause Pidgin to crash, leading to a denial of service. (CVE-2012-2318)

Ulf Härnhammar discovered that Pidgin incorrectly handled messages with in-line images in the MXit protocol handler. A remote attacker could send a specially crafted message and possibly execute arbitrary code with user privileges. (CVE-2012-3374)

Update instructions

The problem can be corrected by updating your system to the following package versions:

Ubuntu 12.04 LTS

finch - 1:2.10.3-0ubuntu1.1

libpurple0 - 1:2.10.3-0ubuntu1.1

pidgin - 1:2.10.3-0ubuntu1.1

Ubuntu 11.10

finch - 1:2.10.0-0ubuntu2.1

libpurple0 - 1:2.10.0-0ubuntu2.1

pidgin - 1:2.10.0-0ubuntu2.1

Ubuntu 11.04

finch - 1:2.7.11-1ubuntu2.2

libpurple0 - 1:2.7.11-1ubuntu2.2

pidgin - 1:2.7.11-1ubuntu2.2

Ubuntu 10.04 LTS

finch - 1:2.6.6-1ubuntu4.5

libpurple0 - 1:2.6.6-1ubuntu4.5

pidgin - 1:2.6.6-1ubuntu4.5

To update your system, please follow these instructions: https://wiki.ubuntu.com/Security/Upgrades.

After a standard system update you need to restart Pidgin to make all the necessary changes.

References

• CVE-2011-4601
• CVE-2011-4602
• CVE-2011-4603
• CVE-2011-4922
• CVE-2011-4939
• CVE-2012-1178
• CVE-2012-2214
• CVE-2012-2318
• CVE-2012-3374