CentOS 5 / 6 : pidgin (CESA-2014:0139)

Updated pidgin packages that fix multiple security issues are now available for Red Hat Enterprise Linux 5 and 6. The Red Hat Security Response Team has rated this update as having moderate security impact. Common Vulnerability Scoring System CVSS base scores, which give detailed severity ratings...

finch, libpurple, pidgin security update

CentOS Errata and Security Advisory CESA-2014:0139 Updated pidgin packages that fix multiple security issues are now available for Red Hat Enterprise Linux 5 and 6. The Red Hat Security Response Team has rated this update as having moderate security impact. Common Vulnerability Scoring System CVS...

CVE-2012-0059

A flaw was found in Spacewalk-backend. This information disclosure vulnerability occurs when a system registration XML-RPC call fails, causing cleartext user passwords to be included in error messages. Remote administrators can exploit this by reading server logs and emails, leading to the...

CVE-2012-0059

CVE-2012-0059 affects the Spacewalk-backend in Red Hat Network Satellite and Proxy 5.4. A vulnerability in the system-registration XML-RPC error handling causes cleartext RHN user passwords to be included in error messages, exposing credentials via server logs and automated emails. This disclosur...

CVE-2012-6152

The Yahoo! protocol plugin in libpurple in Pidgin before 2.10.8 does not properly validate UTF-8 data, which allows remote attackers to cause a denial of service application crash via crafted byte sequences...

pidgin security update

2.7.9-27.el6 - Fix regression in CVE-2013-6483. 2.7.9-26.el6 - Fix patch for CVE-2012-6152 RH bug 1058242. 2.7.9-25.el6 - Add patch for CVE-2014-0020 RH bug 1058242. 2.7.9-24.el6 - Add patch for CVE-2013-6490 RH bug 1058242. 2.7.9-23.el6 - Add patch for CVE-2013-6489 RH bug 1058242. 2.7.9-22.el6 ...

CVE-2012-0875

SystemTap 1.7, 1.6.7, and probably other versions, when unprivileged mode is enabled, allows local users to obtain sensitive information from kernel memory or cause a denial of service kernel panic and crash via vectors related to crafted DWARF data, which triggers a read of an invalid pointer...

CVE-2012-2108

Stack-based buffer overflow in the main function in util/lpcimain.c in Csound before 5.17.2, when converting a file, allows user-assisted remote attackers to execute arbitrary code via a crafted file...

CVE-2012-2107

Integer overflow in the main function in util/lpcimain.c in Csound before 5.17.2, when converting a file, allows user-assisted remote attackers to execute arbitrary code via a crafted file, which triggers a heap-based buffer overflow...

UBUNTU-CVE-2012-2106

Integer overflow in the pvimport function in util/pvimport.c in Csound 5.16.6, when converting a file, allows remote attackers to execute arbitrary code via a crafted file, which triggers a heap-based buffer overflow...

CVE-2012-0875

Affected software: SystemTap (examples cited: 1.7, 1.6.7; other versions likely affected). Vulnerability cause: When unprivileged mode is enabled, crafted DWARF data can trigger an invalid pointer read, enabling local users to read kernel memory or cause a kernel panic/DoS. Impact: Local informat...

CVE-2012-0875

SystemTap 1.7, 1.6.7, and probably other versions, when unprivileged mode is enabled, allows local users to obtain sensitive information from kernel memory or cause a denial of service kernel panic and crash via vectors related to crafted DWARF data, which triggers a read of an invalid pointer...

CVE-2012-2106

Integer overflow in the pvimport function in util/pvimport.c in Csound 5.16.6, when converting a file, allows remote attackers to execute arbitrary code via a crafted file, which triggers a heap-based buffer overflow...

CVE-2012-2106

CVE-2012-2106 affects Csound 5.16.6, where an integer overflow in pv_import.c during file conversion enables a heap-based buffer overflow that could allow remote code execution. Several advisories reference the same issue and market it as a remote vulnerability (exploitable via crafted files). Re...

CVE-2012-2108

Csound (affected component: util/lpci_main.c in the core for file conversion) has a stack-based buffer overflow in the main function, exploitable by crafting a file to cause remote code execution. This occurs in versions before 5.17.2. Remediation in documented contexts includes upgrading to a fi...

CVE-2012-2107

Csound prior to 5.17.2 suffers an integer overflow in util/lpci_main.c during file conversion, triggering a heap-based buffer overflow that could allow remote code execution. This is documented across multiple sources (SUSE/OpenSUSE, Ubuntu, Debian osv, etc.). Affected version: Csound

CVE-2012-6493

Cross-site request forgery CSRF vulnerability in Rapid7 Nexpose Security Console before 5.5.4 allows remote attackers to hijack the authentication of unspecified victims for requests that delete scan data and sites via a request to data/site/delete...

pidgin

New pidgin packages are available for Slackware 13.0, 13.1, 13.37, 14.0, 14.1, and -current to fix security issues. Here are the details from the Slackware 14.1 ChangeLog: patches/packages/pidgin-2.10.9-i486-1slack14.1.txz: Upgraded. This update fixes various security issues and other bugs. For...

CVE-2012-2249

Tor before 0.2.3.23-rc allows remote attackers to cause a denial of service assertion failure and daemon exit via a renegotiation attempt that occurs after the initiation of the V3 link protocol...

CVE-2012-2250

CVE-2012-2250 affects Tor before 0.2.3.24-rc. The issue allows remote attackers to cause a denial of service via incorrect link protocol negotiation, resulting in an assertion failure and daemon exit. Several connected sources indicate that upstream fixes were released (e.g., a new upstream tor v...