RHSA-2008:0584: Important: pidgin security and bug fix update
Pidgin is a multi-protocol Internet Messaging client.An integer overflow flaw was found in Pidgin's MSN protocol handler. If auser received a malicious MSN message, it was possible to execute arbitrarycode with the permissions of the user running Pidgin. (CVE-2008-2927)Note: the default Pidgin privacy setting only allows messages from users inthe buddy list. This prevents arbitrary MSN users from exploiting thisflaw.This update also addresses the following bug: when attempting to connect to the ICQ network, Pidgin would fail to connect, present an alert saying the "The client version you are using istoo old", and de-activate the ICQ account. This update restores Pidgin'sability to connect to the ICQ network.All Pidgin users should upgrade to these updated packages, which containbackported patches to resolve these issues.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of RHSA-2008:0584?
The severity of RHSA-2008:0584 is classified as important due to the potential for an integer overflow leading to arbitrary code execution.
How do I fix RHSA-2008:0584?
To fix RHSA-2008:0584, you should upgrade to pidgin version 2.3.1-2.el5_2 or later.
What systems are affected by RHSA-2008:0584?
RHSA-2008:0584 affects systems running versions of pidgin, finch, and libpurple prior to 2.3.1-2.el5_2.
What types of attacks can exploit RHSA-2008:0584?
An attacker can exploit RHSA-2008:0584 by sending a malicious MSN message that can execute arbitrary code.
Is there a workaround for RHSA-2008:0584?
There is no specific workaround for RHSA-2008:0584 other than applying the provided updates to vulnerable packages.