Oracle Solaris Third-Party Patch Update : pidgin (multiple_vulnerabilities_in_pidgin)

The remote Solaris system is missing necessary patches to address security updates : - proxy.c in libpurple in Pidgin before 2.10.4 does not properly handle canceled SOCKS5 connection attempts, which allows user-assisted remote authenticated users to cause a denial of service application crash vi...

[SECURITY] Fedora 21 Update: smack-4.0.6-1.fc21

Smack is an Open Source XMPP Jabber client library for instant messaging and presence. A pure Java library, it can be embedded into your applications to create anything from a full XMPP client to simple XMPP integrations such as sending notification messages and presence-enabling devices...

MGASA-2014-0548 Updated smack packages fix security vulnerabilities

Updated smack packages fix security vulnerabilities: The ServerTrustManager component in the Ignite Realtime Smack XMPP API before 4.0.0-rc1 does not verify basicConstraints and nameConstraints in X.509 certificate chains from SSL servers, which allows man-in-the-middle attackers to spoof servers...

Updated smack packages fix security vulnerabilities

Updated smack packages fix security vulnerabilities: The ServerTrustManager component in the Ignite Realtime Smack XMPP API before 4.0.0-rc1 does not verify basicConstraints and nameConstraints in X.509 certificate chains from SSL servers, which allows man-in-the-middle attackers to spoof servers...

[SECURITY] Fedora 20 Update: smack-3.2.2-6.fc20

Smack is an Open Source XMPP Jabber client library for instant messaging and presence. A pure Java library, it can be embedded into your applications to create anything from a full XMPP client to simple XMPP integrations such as sending notification messages and presence-enabling devices...

SuSE 11.3 Security Update : pidgin (SAT Patch Number 10078)

This pidgin update fixes the following security issues : - remote information leak via crafted XMPP message. CVE-2014-3698. bnc902408 - denial of service parsing Groupwise server message. CVE-2014-3696. bnc902410 - crash in MXit protocol plug-in CVE-2014-3695. bnc902409 %NASLMINLEVEL 70300 C...

[SECURITY] Fedora 21 Update: smack-3.2.2-8.fc21

Smack is an Open Source XMPP Jabber client library for instant messaging and presence. A pure Java library, it can be embedded into your applications to create anything from a full XMPP client to simple XMPP integrations such as sending notification messages and presence-enabling devices...

[slackware-security] pidgin

New pidgin packages are available for Slackware 13.0, 13.1, 13.37, 14.0, 14.1, and -current. Here are the details from the Slackware 14.1 ChangeLog: patches/packages/pidgin-2.10.11-i486-1slack14.1.txz: Upgraded. This update contains login fixes for MSN and some XMPP servers. Where to find the new...

THC-Hydra 8.1 - Network Logon Cracker

A very fast network logon cracker which support many different services. See feature sets and services coverage page - incl. a speed comparison against ncrack and medusa.Number one of the biggest security holes are passwords, as every password security study shows. This tool is a proof of concept...

Pidgin Multiple Vulnerabilities (Nov 2014) - Windows

Pidgin is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2014 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:pidgin:pidgin"; ifdescription...

openSUSE Security Update : pidgin (openSUSE-SU-2014:1397-1)

Update to version 2.10.10 : + General : - Check the basic constraints extension when validating SSL/TLS certificates. This fixes a security hole that allowed a malicious man-in-the-middle to impersonate an IM server or any other https endpoint. This affected both the NSS and GnuTLS plugins...

openSUSE Security Update : pidgin (openSUSE-SU-2014:1376-1)

The following issues were fixed in this update : + General : - Check the basic constraints extension when validating SSL/TLS certificates. This fixes a security hole that allowed a malicious man-in-the-middle to impersonate an IM server or any other https endpoint. This affected both the NSS and...

Pidgin 2.10.10 Patches SSL MiTM, DoS Vulnerabilities

A handful of security vulnerabilities were patched in the most recent release of the Pidgin open source instant messaging client, Pidgin 2.10.10, including a SSL/TLS certificate validation issue that could be exploited in man-in-the-middle attacks. Reported by Jacob Appelbaum of the Tor Project,...

Pidgin multiple security vulnerabilities

Insufficient certificate validation, emoticons parsing DoS, Groupwise messages DoS, information leakages via XMPP...

CVE-2014-3698

The jabberidnvalidate function in jutil.c in the Jabber protocol plugin in libpurple in Pidgin before 2.10.10 allows remote attackers to obtain sensitive information from process memory via a crafted XMPP message...

Memory corruption

The jabberidnvalidate function in jutil.c in the Jabber protocol plugin in libpurple in Pidgin before 2.10.10 allows remote attackers to obtain sensitive information from process memory via a crafted XMPP message...

CVE-2014-3698

The jabberidnvalidate function in jutil.c in the Jabber protocol plugin in libpurple in Pidgin before 2.10.10 allows remote attackers to obtain sensitive information from process memory via a crafted XMPP message...

CVE-2014-3698

CVE-2014-3698 affects Pidgin/libpurple (Jabber/XMPP) via the jabber_idn_validate function in jutil.c. A crafted XMPP message can cause the process to disclose memory belonging to the pidgin process (information disclosure). Upstream references and security advisories document this alongside relat...

CVE-2014-3698

The jabberidnvalidate function in jutil.c in the Jabber protocol plugin in libpurple in Pidgin before 2.10.10 allows remote attackers to obtain sensitive information from process memory via a crafted XMPP message...

USN-2390-1: Pidgin vulnerabilities

Jacob Appelbaum and an anonymous person discovered that Pidgin incorrectly handled certificate validation. A remote attacker could exploit this to perform a machine-in-the-middle attack to view sensitive information or alter encrypted communications. CVE-2014-3694 Yves Younan and Richard Johnson...