Moderate: Red Hat Security Advisory: pidgin security, bug fix, and enhancement update

An update for pidgin is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the...

pidgin: remote information leak via crafted XMPP message

An information disclosure flaw was discovered in the way Pidgin parsed XMPP messages. A malicious remote server or a man-in-the-middle attacker could potentially use this flaw to disclose a portion of memory belonging to the Pidgin process by sending a specially crafted XMPP message...

pidgin: Out-of-bounds write in purple_markup_unescape_entity triggered by invalid XML

An out-of-bounds write flaw was found in the way Pidgin processed XML content. A malicious remote server could potentially use this flaw to crash Pidgin or execute arbitrary code in the context of the pidgin process...

pidgin: SSL/TLS plug-ins failed to check Basic Constraints

It was found that Pidgin's SSL/TLS plug-ins had a flaw in the certificate validation functionality. An attacker could use this flaw to create a fake certificate, that Pidgin would trust, which could be used to conduct man-in-the-middle attacks against Pidgin...

Vulnerabilities in the Pidgin instant messaging program, which allow a hacker to trigger memory disclosure, as well as the ability to inject arbitrary code

The multiple vulnerabilities related to memory corruption in the Pidgin instant messaging application are linked to the processing of the MXIT protocol. Exploiting these vulnerabilities can allow a remote attacker to trigger memory disclosure and the injection of arbitrary code by sending special...

EulerOS 2.0 SP2 : pidgin (EulerOS-SA-2017-1131)

According to the version of the pidgin package installed, the EulerOS installation on the remote host is affected by the following vulnerability : - markup.c in the MXit protocol plugin in libpurple in Pidgin before 2.10.10 allows remote servers to cause a denial of service application crash via ...

GLSA-201706-10 : Pidgin: Arbitrary code execution

The remote host is affected by the vulnerability described in GLSA-201706-10 Pidgin: Arbitrary code execution Joseph Bisch discovered that Pidgin incorrectly handled certain xml messages. Impact : A remote attacker could send a specially crafted instant message, possibly resulting in execution of...

Pidgin: Arbitrary code execution

Background Pidgin is a GTK Instant Messenger client for a variety of instant messaging protocols. Description Joseph Bisch discovered that Pidgin incorrectly handled certain xml messages. Impact A remote attacker could send a specially crafted instant message, possibly resulting in execution of...

openSUSE Security Update : pidgin (openSUSE-2017-457)

This update for pidgin to version 2.12.0 fixes the following issues : This security issue was fixed : - CVE-2017-2640: Out of bounds memory read in purplemarkupunescapeentity boo1028835. These non-security issues were fixed : + libpurple : - Fix the use of uninitialised memory if running...

openSUSE: Security Advisory for pidgin (openSUSE-SU-2017:0973-1)

The remote host is missing an update for the Copyright C 2017 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

Security update for pidgin (important)

This update for pidgin to version 2.12.0 fixes the following issues: This security issue was fixed: - CVE-2017-2640: Out of bounds memory read in purplemarkupunescapeentity boo1028835. These non-security issues were fixed: + libpurple: - Fix the use of uninitialised memory if running...

openSUSE Security Update : pidgin (openSUSE-2017-431)

This update for pidgin fixes the following issues : Feature update : - Update to GNOME 3.20.2 fate318572. Security issues fixed : - CVE-2017-2640: Fix an out of bounds memory read in purplemarkupunescapeentity. boo1028835 - CVE-2014-3698: remote information leak via crafted XMPP message boo902408...

Updated pidgin packages fix security vulnerability

A server controlled by an attacker can send an invalid XML that can trigger an out-of-bound memory access. This might lead to a crash or, in some extreme cases, to remote code execution in the client-side CVE-2017-2640. The pidgin package has been updated to version 2.12.0, which fixes this issue...

MGASA-2017-0102 Updated pidgin packages fix security vulnerability

A server controlled by an attacker can send an invalid XML that can trigger an out-of-bound memory access. This might lead to a crash or, in some extreme cases, to remote code execution in the client-side CVE-2017-2640. The pidgin package has been updated to version 2.12.0, which fixes this issue...

openSUSE Security Update : pidgin (openSUSE-2017-410)

This update for pidgin fixes the following issues : Feature update : - Update to GNOME 3.20.2 fate318572. Security issues fixed : - CVE-2017-2640: Fix an out of bounds memory read in purplemarkupunescapeentity. boo1028835 Bugfixes - Correctly remove .so files for plugins fixes...

Pidgin Encryption Problem Vulnerability

Pidgin is a cross-platform real-time communication client that supports several commonly used real-time communication protocols and allows users to log into different real-time communication services with the same software. A security vulnerability exists in Pidgin that stems from the program's u...

Pidgin < 2.12.0 libpurple/util.c purple_markup_unescape_entity() XML Entity Handling RCE

The version of Pidgin installed on the remote Windows host is prior to 2.12.0. It is, therefore, affected by a remote code execution vulnerability in the libpurple library in util.c due to an out-of-bounds writer error in the purplemarkupunescapeentity function that is triggered when handling...

Code Execution Vulnerability Found in Libpurple IM Library

A severe vulnerability has been disclosed in libpurple, the library used in the development of a number of popular instant messaging clients, including Pidgin and Adium for the macOS platform. Adium 1.5.10.2 is vulnerable and can be exploited to run arbitrary code remotely. A researcher who goes ...

[slackware-security] pidgin

New pidgin packages are available for Slackware 13.0, 13.1, 13.37, 14.0, 14.1, 14.2, and -current to fix a security issue. Here are the details from the Slackware 14.2 ChangeLog: patches/packages/pidgin-2.12.0-i586-1slack14.2.txz: Upgraded. This update fixes a minor security issue out of bounds...

Pidgin Out-of-Bounds Write Vulnerability

Pidgin is a multi-protocol instant messaging software. Pidgin suffers from an out-of-bounds write vulnerability. An attacker can exploit this vulnerability to execute arbitrary code or perform unauthorized operations, resulting in a denial of service...