Scientific Linux Security Update : pidgin on SL7.x x86_64 (20170801)

critical Nessus Plugin ID 102651

Language:

Synopsis

The remote Scientific Linux host is missing one or more security updates.

Description

The following packages have been upgraded to a later upstream version:
pidgin (2.10.11).

Security Fix(es) :

- A denial of service flaw was found in the way Pidgin's Mxit plug-in handled emoticons. A malicious remote server or a man-in-the-middle attacker could potentially use this flaw to crash Pidgin by sending a specially crafted emoticon. (CVE-2014-3695)

- A denial of service flaw was found in the way Pidgin parsed Groupwise server messages. A malicious remote server or a man-in-the-middle attacker could potentially use this flaw to cause Pidgin to consume an excessive amount of memory, possibly leading to a crash, by sending a specially crafted message. (CVE-2014-3696)

- An information disclosure flaw was discovered in the way Pidgin parsed XMPP messages. A malicious remote server or a man-in-the-middle attacker could potentially use this flaw to disclose a portion of memory belonging to the Pidgin process by sending a specially crafted XMPP message. (CVE-2014-3698)

- An out-of-bounds write flaw was found in the way Pidgin processed XML content. A malicious remote server could potentially use this flaw to crash Pidgin or execute arbitrary code in the context of the pidgin process.
(CVE-2017-2640)

- It was found that Pidgin's SSL/TLS plug-ins had a flaw in the certificate validation functionality. An attacker could use this flaw to create a fake certificate, that Pidgin would trust, which could be used to conduct man-in-the-middle attacks against Pidgin.
(CVE-2014-3694)

Solution

Update the affected packages.

Plugin Details

Severity: Critical

ID: 102651

File Name: sl_20170801_pidgin_on_SL7_x.nasl

Version: 3.7

Type: local

Agent: unix

Family: Scientific Linux Local Security Checks

Published: 8/22/2017

Updated: 11/26/2025

Supported Sensors: Nessus Agent, Nessus

Risk Information

VPR

Risk Factor: Medium

Score: 6.7

CVSS v2

Risk Factor: High

Base Score: 7.5

Temporal Score: 5.5

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P

CVSS Score Source: CVE-2017-2640

CVSS v3

Risk Factor: Critical

Base Score: 9.8

Temporal Score: 8.5

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

CPE: p-cpe:/a:fermilab:scientific_linux:pidgin-perl, p-cpe:/a:fermilab:scientific_linux:pidgin, p-cpe:/a:fermilab:scientific_linux:libpurple-devel, p-cpe:/a:fermilab:scientific_linux:libpurple-perl, p-cpe:/a:fermilab:scientific_linux:pidgin-debuginfo, x-cpe:/o:fermilab:scientific_linux, p-cpe:/a:fermilab:scientific_linux:pidgin-devel, p-cpe:/a:fermilab:scientific_linux:finch-devel, p-cpe:/a:fermilab:scientific_linux:finch, p-cpe:/a:fermilab:scientific_linux:libpurple-tcl, p-cpe:/a:fermilab:scientific_linux:libpurple

Required KB Items: Host/local_checks_enabled, Host/RedHat/release, Host/RedHat/rpm-list, Host/cpu

Exploit Ease: No known exploits are available

Patch Publication Date: 8/1/2017

Vulnerability Publication Date: 10/29/2014

Reference Information

CVE: CVE-2014-3694, CVE-2014-3695, CVE-2014-3696, CVE-2014-3698, CVE-2017-2640

IAVB: 2017-B-0029

Detections

Analytics