SuSE 11.3 Security Update : finch (SAT Patch Number 9213)

Critical Nessus Plugin ID 74173


The remote SuSE 11 host is missing one or more security updates.


The pidgin Instant Messenger has been updated to fix various security issues :

- Remotely triggerable crash in IRC argument parsing.

- Buffer overflow in SIMPLE header parsing.

- Buffer overflow in MXit emoticon parsing.

- Buffer overflow in Gadu-Gadu HTTP parsing.

- Pidgin uses clickable links to untrusted executables.

- Buffer overflow parsing chunked HTTP responses.

- Crash reading response from STUN server. (CVE-2013-6484)

- XMPP doesn't verify 'from' on some iq replies.

- NULL pointer dereference parsing SOAP data in MSN.

- NULL pointer dereference parsing OIM data in MSN.

- NULL pointer dereference parsing headers in MSN.

- Remote crash reading Yahoo! P2P message. (CVE-2013-6481)

- Remote crash parsing HTTP responses. (CVE-2013-6479)

- Crash when hovering pointer over a long URL.

- Crash handling bad XMPP timestamp. (CVE-2013-6477)

- Yahoo! remote crash from incorrect character encoding.


Apply SAT patch number 9213.

See Also

Plugin Details

Severity: Critical

ID: 74173

File Name: suse_11_finch-140508.nasl

Version: $Revision: 1.1 $

Type: local

Agent: unix

Published: 2014/05/24

Modified: 2014/05/25

Dependencies: 12634

Risk Information

Risk Factor: Critical


Base Score: 10

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C

Vulnerability Information

CPE: p-cpe:/a:novell:suse_linux:11:finch, p-cpe:/a:novell:suse_linux:11:libpurple, p-cpe:/a:novell:suse_linux:11:libpurple-lang, p-cpe:/a:novell:suse_linux:11:libpurple-meanwhile, p-cpe:/a:novell:suse_linux:11:libpurple-tcl, p-cpe:/a:novell:suse_linux:11:pidgin, cpe:/o:novell:suse_linux:11

Required KB Items: Host/local_checks_enabled, Host/cpu, Host/SuSE/release, Host/SuSE/rpm-list

Patch Publication Date: 2014/05/08

Reference Information

CVE: CVE-2012-6152, CVE-2013-6477, CVE-2013-6478, CVE-2013-6479, CVE-2013-6481, CVE-2013-6482, CVE-2013-6483, CVE-2013-6484, CVE-2013-6485, CVE-2013-6486, CVE-2013-6487, CVE-2013-6489, CVE-2013-6490, CVE-2014-0020