A vulnerability in Pidgin might allow remote attackers to execute arbitrary code.

Announced

2017-06-06

Revised

2017-06-06

Access

remote

Bugs

#612188

Advisory

https://security.gentoo.org/glsa/201706-10

Affected packages

Package	Arch	Vulnerable	Unaffected
net-im/pidgin	*	< 2.12.0	>= 2.12.0

Background

Pidgin is a GTK Instant Messenger client for a variety of instant messaging protocols.

Description

Joseph Bisch discovered that Pidgin incorrectly handled certain xml messages.

Impact

A remote attacker could send a specially crafted instant message, possibly resulting in execution of arbitrary code with the privileges of the Pidgin process.

Workaround

There is no known workaround at this time.

Resolution

All Pidgin users should upgrade to the latest version:

# emerge --sync
# emerge --ask --oneshot --verbose ">=net-im/pidgin-2.12.0"

References

• CVE-2017-2640

Multiple vulnerabilities have been found in Pidgin, the worst of which could lead to execution of arbitrary code.

Announced

2017-01-17

Revised

2017-01-17

Access

remote

Bugs

#586698

Advisory

https://security.gentoo.org/glsa/201701-38

Affected packages

Package	Arch	Vulnerable	Unaffected
net-im/pidgin	*	< 2.11.0	>= 2.11.0

Background

Pidgin is a client for a variety of instant messaging protocols.

Description

Multiple vulnerabilities have been discovered in Pidgin. Please review the CVE identifiers referenced below for details.

Impact

A remote attacker might send specially crafted data using the MXit protocol, possibly resulting in the remote execution of arbitrary code with the privileges of the process, a Denial of Service condition, or in leaking confidential information.

Workaround

There is no known workaround at this time.

Resolution

All Pidgin users should upgrade to the latest version:

# emerge --sync
# emerge --ask --oneshot --verbose ">=net-im/pidgin-2.11.0"

References

• CVE-2016-1000030
• CVE-2016-2365
• CVE-2016-2366
• CVE-2016-2367
• CVE-2016-2368
• CVE-2016-2369
• CVE-2016-2370
• CVE-2016-2371
• CVE-2016-2372
• CVE-2016-2373
• CVE-2016-2374
• CVE-2016-2375
• CVE-2016-2376
• CVE-2016-2377
• CVE-2016-2378
• CVE-2016-2379
• CVE-2016-2380
• CVE-2016-4323

Multiple vulnerabilities in Pidgin may allow execution of arbitrary code.

Announced

2014-05-18

Revised

2014-05-18

Access

remote

Bugs

#457580 #499596

Advisory

https://security.gentoo.org/glsa/201405-22

Affected packages

Package	Arch	Vulnerable	Unaffected
net-im/pidgin	*	< 2.10.9	>= 2.10.9, >= 2.10.9-r1 (revision)

Background

Pidgin is a GTK Instant Messenger client for a variety of instant messaging protocols.

Description

Multiple vulnerabilities have been discovered in Pidgin. Please review the CVE identifiers referenced below for details.

Impact

A remote attacker could possibly execute arbitrary code with the privileges of the Pidgin process, cause a Denial of Service condition, overwrite files, or spoof traffic.

Workaround

There is no known workaround at this time.

Resolution

All Pidgin users on HPPA or users of GNOME 3.8 and later on AMD64 or X86 should upgrade to the latest version:

# emerge --sync
# emerge --ask --oneshot --verbose ">=net-im/pidgin-2.10.9-r1"

All Pidgin users on ALPHA, PPC, PPC64, SPARC, and users of GNOME before 3.8 on AMD64 and X86 should upgrade to the latest version:

# emerge --sync
# emerge --ask --oneshot --verbose ">=net-im/pidgin-2.10.9"

References

• CVE-2012-6152
• CVE-2013-0271
• CVE-2013-0272
• CVE-2013-0273
• CVE-2013-0274
• CVE-2013-6477
• CVE-2013-6478
• CVE-2013-6479
• CVE-2013-6481
• CVE-2013-6482
• CVE-2013-6483
• CVE-2013-6484
• CVE-2013-6485
• CVE-2013-6487
• CVE-2013-6489
• CVE-2013-6490
• CVE-2014-0020

A buffer overflow in Pidgin might allow remote attackers to execute arbitrary code or cause Denial of Service.

Announced

2012-09-27

Revised

2012-09-27

Access

remote

Bugs

#425076

Advisory

https://security.gentoo.org/glsa/201209-17

Affected packages

Package	Arch	Vulnerable	Unaffected
net-im/pidgin	*	< 2.10.6	>= 2.10.6

Background

Pidgin is a GTK Instant Messenger client for a variety of instant messaging protocols. libpurple is the core library for Pidgin.

Description

A stack-based buffer overflow vulnerability has been found in the MXit protocol plug-in for libpurple.

Impact

A remote attacker could possibly execute arbitrary code with the privileges of the Pidgin process, or cause a Denial of Service condition.

Workaround

There is no known workaround at this time.

Resolution

All Pidgin users should upgrade to the latest version:

# emerge --sync
# emerge --ask --oneshot --verbose ">=net-im/pidgin-2.10.6"

References

• CVE-2012-3374

Multiple vulnerabilities were found in Pidgin, the worst of which allowing for the remote execution of arbitrary code.

Announced

2012-06-21

Revised

2012-06-21

Access

remote

Bugs

#299751 #372785 #385073

Advisory

https://security.gentoo.org/glsa/201206-11

Affected packages

Package	Arch	Vulnerable	Unaffected
net-im/pidgin	*	< 2.10.0-r1	>= 2.10.0-r1

Background

Pidgin is an GTK Instant Messenger client.

Description

Multiple vulnerabilities have been discovered in Pidgin. Please review the CVE identifiers referenced below for details.

Impact

These vulnerabilities allow for arbitrary file retrieval, Denial of Service and arbitrary code execution with the privileges of the user running Pidgin.

Workaround

There is no known workaround at this time.

Resolution

All Pidgin users should upgrade to the latest version:

# emerge --sync
# emerge --ask --oneshot --verbose ">=net-im/pidgin-2.10.0-r1"

References

• CVE-2010-0013
• CVE-2011-2485
• CVE-2011-3594

Multiple vulnerabilities have been discovered in Pidgin, leading to the remote execution of arbitrary code, unauthorized information disclosure, or Denial of Service.

Announced

2009-10-22

Revised

2009-10-22

Access

remote

Bugs

#276000 #281545 #283324

Advisory

https://security.gentoo.org/glsa/200910-02

Affected packages

Package	Arch	Vulnerable	Unaffected
net-im/pidgin	*	< 2.5.9-r1	>= 2.5.9-r1

Background

Pidgin is a client for a variety of instant messaging protocols.

Description

Multiple vulnerabilities were found in Pidgin:

• Yuriy Kaminskiy reported that the OSCAR protocol implementation in Pidgin misinterprets the ICQWebMessage message type as the ICQSMS message type, triggering an allocation of a large amount of memory (CVE-2009-1889).
• Federico Muttis of Core Security Technologies reported that the msn_slplink_process_msg() function in libpurple/protocols/msn/slplink.c in libpurple as used in Pidgin doesn't properly process incoming SLP messages, triggering an overwrite of an arbitrary memory location (CVE-2009-2694). NOTE: This issue reportedly exists because of an incomplete fix for CVE-2009-1376 (GLSA 200905-07).
• bugdave reported that protocols/jabber/auth.c in libpurple as used in Pidgin does not follow the "require TSL/SSL" preference when connecting to older Jabber servers that do not follow the XMPP specification, resulting in a connection to the server without the expected encryption (CVE-2009-3026).

Impact

A remote attacker could send specially crafted SLP (via MSN) or ICQ web messages, possibly leading to execution of arbitrary code with the privileges of the user running Pidgin, unauthorized information disclosure, or a Denial of Service.

Workaround

There is no known workaround at this time.

Resolution

All Pidgin users should upgrade to the latest version:

# emerge --sync
# emerge --ask --oneshot --verbose ">=net-im/pidgin-2.5.9-r1"

References

• CVE-2009-1376
• CVE-2009-1889
• CVE-2009-2694
• CVE-2009-3026
• GLSA 200905-07

Multiple vulnerabilities in Pidgin might allow for the remote execution of arbitrary code or a Denial of Service.

Announced

2009-05-25

Revised

2009-05-25

Access

remote

Bugs

#270811

Advisory

https://security.gentoo.org/glsa/200905-07

Affected packages

Package	Arch	Vulnerable	Unaffected
net-im/pidgin	*	< 2.5.6	>= 2.5.6

Background

Pidgin (formerly Gaim) is an instant messaging client for a variety of instant messaging protocols.

Description

Multiple vulnerabilities have been discovered in Pidgin:

• Veracode reported a boundary error in the "XMPP SOCKS5 bytestream server" when initiating an outgoing file transfer (CVE-2009-1373).
• Ka-Hing Cheung reported a heap corruption flaw in the QQ protocol handler (CVE-2009-1374).
• A memory corruption flaw in "PurpleCircBuffer" was disclosed by Josef Andrysek (CVE-2009-1375).
• The previous fix for CVE-2008-2927 contains a cast from uint64 to size_t, possibly leading to an integer overflow (CVE-2009-1376, GLSA 200901-13).

Impact

A remote attacker could send specially crafted messages or files using the MSN, XMPP or QQ protocols, possibly resulting in the execution of arbitrary code with the privileges of the user running the application, or a Denial of Service. NOTE: Successful exploitation might require the victim's interaction.

Workaround

There is no known workaround at this time.

Resolution

All Pidgin users should upgrade to the latest version:

# emerge --sync
# emerge --ask --oneshot --verbose ">=net-im/pidgin-2.5.6"

References

• CVE-2009-1373
• CVE-2009-1374
• CVE-2009-1375
• CVE-2009-1376
• GLSA 200901-13

Multiple vulnerabilities have been discovered in Pidgin, allowing for remote arbitrary code execution, Denial of Service and service spoofing.

Announced

2009-01-20

Revised

2009-01-20

Access

remote

Bugs

#230045 #234135

Advisory

https://security.gentoo.org/glsa/200901-13

Affected packages

Package	Arch	Vulnerable	Unaffected
net-im/pidgin	*	< 2.5.1	>= 2.5.1

Background

Pidgin (formerly Gaim) is an instant messaging client for a variety of instant messaging protocols. It is based on the libpurple instant messaging library.

Description

Multiple vulnerabilities have been discovered in Pidgin and the libpurple library:

• A participant to the TippingPoint ZDI reported multiple integer overflows in the msn_slplink_process_msg() function in the MSN protocol implementation (CVE-2008-2927).
• Juan Pablo Lopez Yacubian is credited for reporting a use-after-free flaw in msn_slplink_process_msg() in the MSN protocol implementation (CVE-2008-2955).
• The included UPnP server does not limit the size of data to be downloaded for UPnP service discovery, according to a report by Andrew Hunt and Christian Grothoff (CVE-2008-2957).
• Josh Triplett discovered that the NSS plugin for libpurple does not properly verify SSL certificates (CVE-2008-3532).

Impact

A remote attacker could send specially crafted messages or files using the MSN protocol which could result in the execution of arbitrary code or crash Pidgin. NOTE: Successful exploitation might require the victim's interaction. Furthermore, an attacker could conduct man-in-the-middle attacks to obtain sensitive information using bad certificates and cause memory and disk resources to exhaust.

Workaround

There is no known workaround at this time.

Resolution

All Pidgin users should upgrade to the latest version:

# emerge --sync
# emerge --ask --oneshot --verbose ">=net-im/pidgin-2.5.1"

References

• CVE-2008-2927
• CVE-2008-2955
• CVE-2008-2957
• CVE-2008-3532