Updated pidgin packages that fix multiple security issues are now available for Red Hat Enterprise Linux 5 and 6.

The Red Hat Security Response Team has rated this update as having moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

Pidgin is an instant messaging program which can log in to multiple accounts on multiple instant messaging networks simultaneously.

A heap-based buffer overflow flaw was found in the way Pidgin processed certain HTTP responses. A malicious server could send a specially crafted HTTP response, causing Pidgin to crash or potentially execute arbitrary code with the permissions of the user running Pidgin. (CVE-2013-6485)

Multiple heap-based buffer overflow flaws were found in several protocol plug-ins in Pidgin (Gadu-Gadu, MXit, SIMPLE). A malicious server could send a specially crafted message, causing Pidgin to crash or potentially execute arbitrary code with the permissions of the user running Pidgin. (CVE-2013-6487, CVE-2013-6489, CVE-2013-6490)

Multiple denial of service flaws were found in several protocol plug-ins in Pidgin (Yahoo!, XMPP, MSN, stun, IRC). A remote attacker could use these flaws to crash Pidgin by sending a specially crafted message. (CVE-2012-6152, CVE-2013-6477, CVE-2013-6481, CVE-2013-6482, CVE-2013-6484, CVE-2014-0020)

It was found that the Pidgin XMPP protocol plug-in did not verify the origin of 'iq' replies. A remote attacker could use this flaw to spoof an 'iq' reply, which could lead to injection of fake data or cause Pidgin to crash via a NULL pointer dereference. (CVE-2013-6483)

A flaw was found in the way Pidgin parsed certain HTTP response headers. A remote attacker could use this flaw to crash Pidgin via a specially crafted HTTP response header. (CVE-2013-6479)

It was found that Pidgin crashed when a mouse pointer was hovered over a long URL. A remote attacker could use this flaw to crash Pidgin by sending a message containing a long URL string. (CVE-2013-6478)

Red Hat would like to thank the Pidgin project for reporting these issues. Upstream acknowledges Thijs Alkemade, Robert Vehse, Jaime Breva Ribes, Jacob Appelbaum of the Tor Project, Daniel Atallah, Fabian Yamaguchi and Christian Wressnegger of the University of Goettingen, Matt Jones of Volvent, and Yves Younan, Ryan Pentney, and Pawel Janic of Sourcefire VRT as the original reporters of these issues.

All pidgin users are advised to upgrade to these updated packages, which contain backported patches to correct these issues. Pidgin must be restarted for this update to take effect.

Update to 2.10.9

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Thijs Alkemade and Robert Vehse discovered that Pidgin incorrectly handled the Yahoo! protocol. A remote attacker could use this issue to cause Pidgin to crash, resulting in a denial of service.
(CVE-2012-6152)

Jaime Breva Ribes discovered that Pidgin incorrectly handled the XMPP protocol. A remote attacker could use this issue to cause Pidgin to crash, resulting in a denial of service. (CVE-2013-6477)

It was discovered that Pidgin incorrecly handled long URLs. A remote attacker could use this issue to cause Pidgin to crash, resulting in a denial of service. (CVE-2013-6478)

Jacob Appelbaum discovered that Pidgin incorrectly handled certain HTTP responses. A malicious remote server or a man in the middle could use this issue to cause Pidgin to crash, resulting in a denial of service. (CVE-2013-6479)

Daniel Atallah discovered that Pidgin incorrectly handled the Yahoo! protocol. A remote attacker could use this issue to cause Pidgin to crash, resulting in a denial of service. (CVE-2013-6481)

Fabian Yamaguchi and Christian Wressnegger discovered that Pidgin incorrectly handled the MSN protocol. A remote attacker could use this issue to cause Pidgin to crash, resulting in a denial of service.
(CVE-2013-6482)

Fabian Yamaguchi and Christian Wressnegger discovered that Pidgin incorrectly handled XMPP iq replies. A remote attacker could use this issue to spoof messages. (CVE-2013-6483)

It was discovered that Pidgin incorrectly handled STUN server responses. A remote attacker could use this issue to cause Pidgin to crash, resulting in a denial of service. (CVE-2013-6484)

Matt Jones discovered that Pidgin incorrectly handled certain chunked HTTP responses. A malicious remote server or a man in the middle could use this issue to cause Pidgin to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2013-6485)

Yves Younan and Ryan Pentney discovered that Pidgin incorrectly handled certain Gadu-Gadu HTTP messages. A malicious remote server or a man in the middle could use this issue to cause Pidgin to crash, resulting in a denial of service, or possibly execute arbitrary code.
(CVE-2013-6487)

Yves Younan and Pawel Janic discovered that Pidgin incorrectly handled MXit emoticons. A remote attacker could use this issue to cause Pidgin to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2013-6489)

Yves Younan discovered that Pidgin incorrectly handled SIMPLE headers.
A remote attacker could use this issue to cause Pidgin to crash, resulting in a denial of service, or possibly execute arbitrary code.
(CVE-2013-6490)

Daniel Atallah discovered that Pidgin incorrectly handled IRC argument parsing. A malicious remote server or a man in the middle could use this issue to cause Pidgin to crash, resulting in a denial of service.
(CVE-2014-0020).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Solaris system is missing necessary patches to address security updates :

  - The Yahoo! protocol plugin in libpurple in Pidgin before     2.10.8 does not properly validate UTF-8 data, which     allows remote attackers to cause a denial of service     (application crash) via crafted byte sequences.
    (CVE-2012-6152)

  - The MXit protocol plugin in libpurple in Pidgin before     2.10.7 might allow remote attackers to create or     overwrite files via a crafted (1) mxit or (2)     mxit/imagestrips pathname. (CVE-2013-0271)

  - Buffer overflow in http.c in the MXit protocol plugin in     libpurple in Pidgin before 2.10.7 allows remote servers     to execute arbitrary code via a long HTTP header.
    (CVE-2013-0272)

  - sametime.c in the Sametime protocol plugin in libpurple     in Pidgin before 2.10.7 does not properly terminate long     user IDs, which allows remote servers to cause a denial     of service (application crash) via a crafted packet.
    (CVE-2013-0273)

  - upnp.c in libpurple in Pidgin before 2.10.7 does not     properly terminate long strings in UPnP responses, which     allows remote attackers to cause a denial of service     (application crash) by leveraging access to the local     network. (CVE-2013-0274)

  - Multiple integer signedness errors in libpurple in     Pidgin before 2.10.8 allow remote attackers to cause a     denial of service (application crash) via a crafted     timestamp value in an XMPP message. (CVE-2013-6477)

  - gtkimhtml.c in Pidgin before 2.10.8 does not properly     interact with underlying library support for wide Pango     layouts, which allows user-assisted remote attackers to     cause a denial of service (application crash) via a long     URL that is examined with a tooltip. (CVE-2013-6478)

  - util.c in libpurple in Pidgin before 2.10.8 does not     properly allocate memory for HTTP responses that are     inconsistent with the Content-Length header, which     allows remote HTTP servers to cause a denial of service     (application crash) via a crafted response.
    (CVE-2013-6479)

  - libpurple/protocols/yahoo/libymsg.c in Pidgin before     2.10.8 allows remote attackers to cause a denial of     service (crash) via a Yahoo! P2P message with a crafted     length field, which triggers a buffer over-read.
    (CVE-2013-6481)

  - Pidgin before 2.10.8 allows remote MSN servers to cause     a denial of service (NULL pointer dereference and crash)     via a crafted (1) SOAP response, (2) OIM XML response,     or (3) Content-Length header. (CVE-2013-6482)

  - The XMPP protocol plugin in libpurple in Pidgin before     2.10.8 does not properly determine whether the from     address in an iq reply is consistent with the to address     in an iq request, which allows remote attackers to spoof     iq traffic or cause a denial of service (NULL pointer     dereference and application crash) via a crafted reply.
    (CVE-2013-6483)

  - The STUN protocol implementation in libpurple in Pidgin     before 2.10.8 allows remote STUN servers to cause a     denial of service (out-of-bounds write operation and     application crash) by triggering a socket read error.
    (CVE-2013-6484)

  - Buffer overflow in util.c in libpurple in Pidgin before     2.10.8 allows remote HTTP servers to cause a denial of     service (application crash) or possibly have unspecified     other impact via an invalid chunk-size field in chunked     transfer-coding data. (CVE-2013-6485)

  - gtkutils.c in Pidgin before 2.10.8 on Windows allows     user-assisted remote attackers to execute arbitrary     programs via a message containing a file: URL that is     improperly handled during construction of an     explorer.exe command. NOTE: this vulnerability exists     because of an incomplete fix for CVE-2011-3185.
    (CVE-2013-6486)

  - Integer overflow in libpurple/protocols/gg/lib/http.c in     the Gadu-Gadu (gg) parser in Pidgin before 2.10.8 allows     remote attackers to have an unspecified impact via a     large Content-Length value, which triggers a buffer     overflow. (CVE-2013-6487)

  - Integer signedness error in the MXit functionality in     Pidgin before 2.10.8 allows remote attackers to cause a     denial of service (segmentation fault) via a crafted     emoticon value, which triggers an integer overflow and a     buffer overflow. (CVE-2013-6489)

  - The SIMPLE protocol functionality in Pidgin before     2.10.8 allows remote attackers to have an unspecified     impact via a negative Content-Length header, which     triggers a buffer overflow. (CVE-2013-6490)

  - The IRC protocol plugin in libpurple in Pidgin before     2.10.8 does not validate argument counts, which allows     remote IRC servers to cause a denial of service     (application crash) via a crafted message.
    (CVE-2014-0020)

A heap-based buffer overflow flaw was found in the way Pidgin processed certain HTTP responses. A malicious server could send a specially crafted HTTP response, causing Pidgin to crash or potentially execute arbitrary code with the permissions of the user running Pidgin. (CVE-2013-6485)

Multiple heap-based buffer overflow flaws were found in several protocol plug-ins in Pidgin (Gadu-Gadu, MXit, SIMPLE). A malicious server could send a specially crafted message, causing Pidgin to crash or potentially execute arbitrary code with the permissions of the user running Pidgin. (CVE-2013-6487, CVE-2013-6489, CVE-2013-6490)

Multiple denial of service flaws were found in several protocol plug-ins in Pidgin (Yahoo!, XMPP, MSN, stun, IRC). A remote attacker could use these flaws to crash Pidgin by sending a specially crafted message. (CVE-2012-6152, CVE-2013-6477, CVE-2013-6481, CVE-2013-6482, CVE-2013-6484, CVE-2014-0020)

It was found that the Pidgin XMPP protocol plug-in did not verify the origin of 'iq' replies. A remote attacker could use this flaw to spoof an 'iq' reply, which could lead to injection of fake data or cause Pidgin to crash via a NULL pointer dereference. (CVE-2013-6483)

A flaw was found in the way Pidgin parsed certain HTTP response headers. A remote attacker could use this flaw to crash Pidgin via a specially crafted HTTP response header. (CVE-2013-6479)

It was found that Pidgin crashed when a mouse pointer was hovered over a long URL. A remote attacker could use this flaw to crash Pidgin by sending a message containing a long URL string. (CVE-2013-6478)

Pidgin must be restarted for this update to take effect.

ID	Name	Product	Family	Published	Updated	Severity
72352	CentOS 5 / 6 : pidgin (CESA-2014:0139)	Nessus	CentOS Local Security Checks	2/6/2014	1/4/2021	critical
72359	Fedora 20 : pidgin-2.10.9-1.fc20 (2014-2013)	Nessus	Fedora Local Security Checks	2/6/2014	1/11/2021	critical
72386	Ubuntu 12.04 LTS / 12.10 / 13.10 : pidgin vulnerabilities (USN-2100-1)	Nessus	Ubuntu Local Security Checks	2/7/2014	1/19/2021	critical
72519	Fedora 19 : pidgin-2.10.9-1.fc19 (2014-1999)	Nessus	Fedora Local Security Checks	2/17/2014	1/11/2021	critical
80740	Oracle Solaris Third-Party Patch Update : pidgin (multiple_vulnerabilities_in_pidgin2)	Nessus	Solaris Local Security Checks	1/19/2015	1/14/2021	critical
72365	Scientific Linux Security Update : pidgin on SL5.x, SL6.x i386/x86_64 (20140205)	Nessus	Scientific Linux Local Security Checks	2/6/2014	1/14/2021	critical

Detections

Analytics

Plugins Search

critical

critical

critical

critical

critical

critical