[SECURITY] [DSA 2509-1] pidgin security update

2012-07-0819:49:39

lists.debian.org

7.5 High

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

0.26 Low

EPSS

Percentile

96.7%

JSON

Debian Security Advisory DSA-2509-1 [email protected]
http://www.debian.org/security/ Luciano Bello
July 08, 2012 http://www.debian.org/security/faq

Package : pidgin
Vulnerability : remote code execution
Problem type : remote
Debian-specific: no
CVE ID : CVE-2012-3374
Debian Bug : #680661

Ulf HÃ¤rnhammar found a buffer overflow in Pidgin, a multi protocol instant
messaging client. The vulnerability can be exploited by an incoming
message in the MXit protocol plugin. A remote attacker may cause a crash,
and in some circumstances can lead to remote code execution.

For the stable distribution (squeeze), this problem has been fixed in
version 2.7.3-1+squeeze3.

For the testing distribution (wheezy), this problem has been fixed in
version 2.10.4-1.1.

For the unstable distribution (sid), this problem has been fixed in
version 2.10.6-1.

We recommend that you upgrade your pidgin packages.

Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: http://www.debian.org/security/

Mailing list: [email protected]

OSVersionArchitecturePackageVersionFilename
Debian6allfinch-dev< 2.7.3-1+squeeze3finch-dev_2.7.3-1+squeeze3_all.deb
Debian6alllibpurple-dev< 2.7.3-1+squeeze3libpurple-dev_2.7.3-1+squeeze3_all.deb
Debian6s390pidgin-dbg< 2.7.3-1+squeeze3pidgin-dbg_2.7.3-1+squeeze3_s390.deb
Debian6allpidgin-data< 2.7.3-1+squeeze3pidgin-data_2.7.3-1+squeeze3_all.deb
Debian6kfreebsd-i386finch< 2.7.3-1+squeeze3finch_2.7.3-1+squeeze3_kfreebsd-i386.deb
Debian6amd64pidgin-dbg< 2.7.3-1+squeeze3pidgin-dbg_2.7.3-1+squeeze3_amd64.deb
Debian6ia64finch< 2.7.3-1+squeeze3finch_2.7.3-1+squeeze3_ia64.deb
Debian6armelpidgin< 2.7.3-1+squeeze3pidgin_2.7.3-1+squeeze3_armel.deb
Debian6i386libpurple0< 2.7.3-1+squeeze3libpurple0_2.7.3-1+squeeze3_i386.deb
Debian6amd64libpurple0< 2.7.3-1+squeeze3libpurple0_2.7.3-1+squeeze3_amd64.deb

OS	Version	Architecture	Package	Version	Filename
Debian	6	all	finch-dev	< 2.7.3-1+squeeze3	finch-dev_2.7.3-1+squeeze3_all.deb
Debian	6	all	libpurple-dev	< 2.7.3-1+squeeze3	libpurple-dev_2.7.3-1+squeeze3_all.deb
Debian	6	s390	pidgin-dbg	< 2.7.3-1+squeeze3	pidgin-dbg_2.7.3-1+squeeze3_s390.deb
Debian	6	all	pidgin-data	< 2.7.3-1+squeeze3	pidgin-data_2.7.3-1+squeeze3_all.deb
Debian	6	kfreebsd-i386	finch	< 2.7.3-1+squeeze3	finch_2.7.3-1+squeeze3_kfreebsd-i386.deb
Debian	6	amd64	pidgin-dbg	< 2.7.3-1+squeeze3	pidgin-dbg_2.7.3-1+squeeze3_amd64.deb
Debian	6	ia64	finch	< 2.7.3-1+squeeze3	finch_2.7.3-1+squeeze3_ia64.deb
Debian	6	armel	pidgin	< 2.7.3-1+squeeze3	pidgin_2.7.3-1+squeeze3_armel.deb
Debian	6	i386	libpurple0	< 2.7.3-1+squeeze3	libpurple0_2.7.3-1+squeeze3_i386.deb
Debian	6	amd64	libpurple0	< 2.7.3-1+squeeze3	libpurple0_2.7.3-1+squeeze3_amd64.deb