A directory traversal flaw was discovered in Pidgin's MSN protocol implementation. A remote attacker could send a specially crafted emoticon image download request that would cause Pidgin to disclose an arbitrary file readable to the user running Pidgin. (CVE-2010-0013)

These packages upgrade Pidgin to version 2.6.5.

Pidgin must be restarted for this update to take effect.

From Red Hat Security Advisory 2010:0044 :

Updated pidgin packages that fix a security issue are now available for Red Hat Enterprise Linux 4 and 5.

This update has been rated as having important security impact by the Red Hat Security Response Team.

Pidgin is an instant messaging program which can log in to multiple accounts on multiple instant messaging networks simultaneously.

A directory traversal flaw was discovered in Pidgin's MSN protocol implementation. A remote attacker could send a specially crafted emoticon image download request that would cause Pidgin to disclose an arbitrary file readable to the user running Pidgin. (CVE-2010-0013)

These packages upgrade Pidgin to version 2.6.5. Refer to the Pidgin release notes for a full list of changes:
http://developer.pidgin.im/wiki/ChangeLog

All Pidgin users should upgrade to these updated packages, which correct this issue. Pidgin must be restarted for this update to take effect.

New pidgin packages are available for Slackware 12.0, 12.1, 12.2, 13.0, and -current to fix a security issue.

- CVE-2010-0013 - A few other bug fixes

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

New release 2.7.5

Full Upstream ChangeLog :

  -     http://developer.pidgin.im/wiki/ChangeLog#version2.7.410     202010

    -       http://developer.pidgin.im/wiki/ChangeLog#version2.7.5       10312010

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update of pidgin fixes various security vulnerabilities :

  - Remote file disclosure vulnerability by using the MSN     protocol. CVE-2010-0277: CVSS v2 Base Score: 4.9:
    Resource Management Errors (CWE-399) MSN protocol plugin     in libpurple allowed remote attackers to cause a denial     of service (memory corruption) at least. CVE-2010-0420:
    Same nick names in XMPP MUC lead to a crash in finch.
    CVE-2010-0423: A remote denial of service attack     (resource consumption) is possible by sending an IM with     a lot of smilies in it. (CVE-2010-0013: CVSS v2 Base     Score: 4.3: Path Traversal (CWE-22))

2.7.0 with new features, bug fixes and a security fix for CVE-2010-1624 Full Upstream ChangeLog: * http://developer.pidgin.im/wiki/ChangeLog Fedora packaging changes: * Use System SSL Certificates * Add additional dependencies for Voice + Video

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

New release to address a security issue and a couple of bugfixes Details at http://developer.pidgin.im/wiki/ChangeLog

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Redhat Enterprise Linux 4 / 5 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2010:0044 advisory.

    Pidgin is an instant messaging program which can log in to multiple     accounts on multiple instant messaging networks simultaneously.

    A directory traversal flaw was discovered in Pidgin's MSN protocol     implementation. A remote attacker could send a specially-crafted emoticon     image download request that would cause Pidgin to disclose an arbitrary     file readable to the user running Pidgin. (CVE-2010-0013)

    These packages upgrade Pidgin to version 2.6.5. Refer to the Pidgin release     notes for a full list of changes: http://developer.pidgin.im/wiki/ChangeLog

    All Pidgin users should upgrade to these updated packages, which correct     this issue. Pidgin must be restarted for this update to take effect.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

This update of pidgin fixes various security vulnerabilities

  - CVE-2010-0013: CVSS v2 Base Score: 4.3: Path Traversal     (CWE-22) Remote file disclosure vulnerability by using     the MSN protocol.

  - CVE-2010-0277: CVSS v2 Base Score: 4.9: Resource     Management Errors (CWE-399) MSN protocol plugin in     libpurple allowed remote attackers to cause a denial of     service (memory corruption) at least.

  - CVE-2010-0420 Same nick names in XMPP MUC lead to a     crash in finch.

  - CVE-2010-0423 A remote denial of service attack     (resource consumption) is possible by sending an IM with     a lot of smilies in it.

ID	Name	Product	Family	Published	Updated	Severity
60724	Scientific Linux Security Update : pidgin on SL4.x, SL5.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	8/1/2012	1/14/2021	medium
67987	Oracle Linux 4 : pidgin (ELSA-2010-0044)	Nessus	Oracle Linux Local Security Checks	7/12/2013	1/14/2021	medium
44122	Slackware 12.0 / 12.1 / 12.2 / 13.0 / current : pidgin (SSA:2010-024-03)	Nessus	Slackware Local Security Checks	1/25/2010	1/14/2021	medium
47184	Fedora 11 : pidgin-2.6.5-1.fc11 (2010-0429)	Nessus	Fedora Local Security Checks	7/1/2010	1/11/2021	critical
50556	Fedora 12 : pidgin-2.7.5-1.fc12 (2010-17130)	Nessus	Fedora Local Security Checks	11/11/2010	1/11/2021	medium
51727	SuSE 10 Security Update : pidgin (ZYPP Patch Number 6856)	Nessus	SuSE Local Security Checks	1/27/2011	1/14/2021	medium
47496	Fedora 12 : pidgin-2.7.0-2.fc12 (2010-8524)	Nessus	Fedora Local Security Checks	7/1/2010	1/11/2021	medium
48206	Fedora 12 : pidgin-2.7.2-1.fc12 (2010-11315)	Nessus	Fedora Local Security Checks	8/2/2010	1/11/2021	medium
44030	RHEL 4 / 5 : pidgin (RHSA-2010:0044)	Nessus	Red Hat Local Security Checks	1/15/2010	11/4/2024	high
44976	openSUSE Security Update : finch (finch-2032)	Nessus	SuSE Local Security Checks	3/4/2010	1/14/2021	medium
44979	openSUSE Security Update : finch (finch-2032)	Nessus	SuSE Local Security Checks	3/4/2010	1/14/2021	medium

Detections

Analytics

Plugins Search

medium

medium

medium

critical

medium

medium

medium

medium

high

medium

medium