Slackware 13.0 / 13.1 / 13.37 / 14.0 / 14.1 / current : pidgin (SSA:2014-344-05)

New pidgin packages are available for Slackware 13.0, 13.1, 13.37, 14.0, 14.1, and -current. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from Slackware Security Advisory 2014-344-05. The text itself is copyright C...

SuSE 11.3 Security Update : pidgin (SAT Patch Number 10078)

This pidgin update fixes the following security issues : - remote information leak via crafted XMPP message. CVE-2014-3698. bnc902408 - denial of service parsing Groupwise server message. CVE-2014-3696. bnc902410 - crash in MXit protocol plug-in CVE-2014-3695. bnc902409 %NASLMINLEVEL 70300 C...

[slackware-security] pidgin

New pidgin packages are available for Slackware 13.0, 13.1, 13.37, 14.0, 14.1, and -current. Here are the details from the Slackware 14.1 ChangeLog: patches/packages/pidgin-2.10.11-i486-1slack14.1.txz: Upgraded. This update contains login fixes for MSN and some XMPP servers. Where to find the new...

Combined with the middleman attack, the Pidgin tasteless vulnerability becomes waste into treasure-vulnerability warning-the black bar safety net

The latest version of the open source instant messaging clientPidgin 2.10.10 all this time to fix a series of vulnerabilities, wherein the SSL/TLS certificate validation issue can be exploited by hackers to make MiTM attacks. As a result, some slightly tasteless the vulnerability with man in the...

Pidgin Multiple Vulnerabilities (Nov 2014) - Windows

Pidgin is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2014 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:pidgin:pidgin"; ifdescription...

openSUSE Security Update : pidgin (openSUSE-SU-2014:1397-1)

Update to version 2.10.10 : + General : - Check the basic constraints extension when validating SSL/TLS certificates. This fixes a security hole that allowed a malicious man-in-the-middle to impersonate an IM server or any other https endpoint. This affected both the NSS and GnuTLS plugins...

Fedora 21 : pidgin-2.10.10-2.fc21 (2014-14112)

fix build on arches without valgrind Update to 2.10.10 Security fix for CVE-2014-3694, CVE-2014-3695, CVE-2014-3696, CVE-2014-3698 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically...

Fedora Update for pidgin FEDORA-2014-14069

Check the version of pidgin SPDX-FileCopyrightText: 2014 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription scriptoid"1.3.6.1.4.1.25623.1.0.868472";...

Fedora 20 : pidgin-2.10.10-1.fc20 (2014-14069)

Update to 2.10.10 Security fix for CVE-2014-3694, CVE-2014-3695, CVE-2014-3696, CVE-2014-3698 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible...

openSUSE Security Update : pidgin (openSUSE-SU-2014:1376-1)

The following issues were fixed in this update : + General : - Check the basic constraints extension when validating SSL/TLS certificates. This fixes a security hole that allowed a malicious man-in-the-middle to impersonate an IM server or any other https endpoint. This affected both the NSS and...

Pidgin 2.10.10 Patches SSL MiTM, DoS Vulnerabilities

A handful of security vulnerabilities were patched in the most recent release of the Pidgin open source instant messaging client, Pidgin 2.10.10, including a SSL/TLS certificate validation issue that could be exploited in man-in-the-middle attacks. Reported by Jacob Appelbaum of the Tor Project,...

[SECURITY] Fedora 20 Update: pidgin-2.10.10-1.fc20

Pidgin allows you to talk to anyone using a variety of messaging protocols including AIM, MSN, Yahoo!, Jabber, Bonjour, Gadu-Gadu, ICQ, IRC, Novell Groupwise, QQ, Lotus Sametime, SILC, Simple and Zephyr. These protocols are implemented using a modular, easy to use design. To use a protocol, just...

[SECURITY] Fedora 21 Update: pidgin-2.10.10-2.fc21

Pidgin allows you to talk to anyone using a variety of messaging protocols including AIM, MSN, Yahoo!, Jabber, Bonjour, Gadu-Gadu, ICQ, IRC, Novell Groupwise, QQ, Lotus Sametime, SILC, Simple and Zephyr. These protocols are implemented using a modular, easy to use design. To use a protocol, just...

Pidgin libpurple Mxit Emoticon ASN Length Denial of Service Vulnerability

Talos Vulnerability Report VRT-2014-0203 Pidgin libpurple Mxit Emoticon ASN Length Denial of Service Vulnerability November 6, 2014 CVE Number CVE-2014-3695 Description An exploitable denial of service vulnerability exists in Pidgin’s implementation of the Mxit protocol in the libpurple library. ...

Pidgin Theme/Smiley Untar Arbitrary File Write Vulnerability

Talos Vulnerability Report VRT-2014-0205 Pidgin Theme/Smiley Untar Arbitrary File Write Vulnerability November 6, 2014 CVE Number CVE-2014-3697 Description An exploitable remote code execution vulnerability exists in Pidgin’s implementation of the TAR archive parsing functionality. An attacker wh...

Pidgin libpurple Novell Protocol Multiple Denial of Service Vulnerabilities

Talos Vulnerability Report VRT-2014-0204 Pidgin libpurple Novell Protocol Multiple Denial of Service Vulnerabilities November 6, 2014 CVE Number CVE-2014-3696 Description Several exploitable denial of service vulnerabilities exist in Pidgin’s implementation of the Novell protocol in the libpurple...

Pidgin multiple security vulnerabilities

Insufficient certificate validation, emoticons parsing DoS, Groupwise messages DoS, information leakages via XMPP...

[USN-2390-1] Pidgin vulnerabilities

========================================================================== Ubuntu Security Notice USN-2390-1 October 28, 2014 pidgin vulnerabilities ========================================================================== A security issue affects these releases of Ubuntu and its derivatives: -...

CVE-2014-3698

The jabberidnvalidate function in jutil.c in the Jabber protocol plugin in libpurple in Pidgin before 2.10.10 allows remote attackers to obtain sensitive information from process memory via a crafted XMPP message...

CVE-2014-3696

nmevent.c in the Novell GroupWise protocol plugin in libpurple in Pidgin before 2.10.10 allows remote servers to cause a denial of service application crash via a crafted server message that triggers a large memory allocation...