Pidgin version <2.11.0 contains a vulnerability in X.509 Certificates imports specifically due to improper check of return values from gnutls_x509_crt_init() and gnutls_x509_crt_import() that can result in code execution. This attack appear to be exploitable via custom X.509 certificate from another client. This vulnerability appears to have been fixed in 2.11.0.

According to the version of the pidgin package installed, the EulerOS installation on the remote host is affected by the following vulnerability :

  - Pidgin version <2.11.0 contains a vulnerability in     X.509 Certificates imports specifically due to improper     check of return values from gnutls_x509_crt_init() and     gnutls_x509_crt_import() that can result in code     execution. This attack appear to be exploitable via     custom X.509 certificate from another     client.(CVE-2016-1000030)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the version of the pidgin package installed, the EulerOS installation on the remote host is affected by the following vulnerability :

  - Pidgin allows you to talk to anyone using a variety of     messaging protocols including AIM, MSN, Yahoo!, Jabber,     Bonjour, Gadu-Gadu, ICQ, IRC, Novell Groupwise, QQ,     Lotus Sametime, Simple and Zephyr. These protocols are     implemented using a modular, easy to use design. To use     a protocol, just add an account using the account     editor. Pidgin supports many common features of other     clients, as well as many unique features, such as perl     scripting, TCL scripting and C plugins. Pidgin is not     affiliated with or endorsed by America Online, Inc.,     Microsoft Corporation, Yahoo! Inc., or ICQ Inc.Security     Fix(es):Pidgin version <2.11.0 contains a vulnerability     in X.509 Certificates imports specifically due to     improper check of return values from     gnutls_x509_crt_init() and gnutls_x509_crt_import()     that can result in code execution. This attack appear     to be exploitable via custom X.509 certificate from     another client.(CVE-2016-1000030)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the version of the pidgin package installed, the EulerOS installation on the remote host is affected by the following vulnerability :

  - Pidgin version <2.11.0 contains a vulnerability in     X.509 Certificates imports specifically due to improper     check of return values from gnutls_x509_crt_init() and     gnutls_x509_crt_import() that can result in code     execution. This attack appear to be exploitable via     custom X.509 certificate from another client.
    (CVE-2016-1000030)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is affected by the vulnerability described in GLSA-201701-38 (Pidgin: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Pidgin. Please review       the CVE identifiers referenced below for details.
  Impact :

    A remote attacker might send specially crafted data using the MXit       protocol, possibly resulting in the remote execution of arbitrary code       with the privileges of the process, a Denial of Service condition, or in       leaking confidential information.
  Workaround :

    There is no known workaround at this time.

ID	Name	Product	Family	Severity
142268	EulerOS 2.0 SP2 : pidgin (EulerOS-SA-2020-2385)	Nessus	Huawei Local Security Checks	critical
142072	EulerOS 2.0 SP5 : pidgin (EulerOS-SA-2020-2262)	Nessus	Huawei Local Security Checks	critical
140829	EulerOS 2.0 SP3 : pidgin (EulerOS-SA-2020-2062)	Nessus	Huawei Local Security Checks	critical
96542	GLSA-201701-38 : Pidgin: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	critical

Detections

Analytics

CVE-2016-1000030

critical

Tenable Plugins

critical

critical

critical

critical