RHSA-2009:1059: Important: pidgin security update

Pidgin is an instant messaging program which can log in to multipleaccounts on multiple instant messaging networks simultaneously.A buffer overflow flaw was found in the way Pidgin initiates file transferswhen using the Extensible Messaging and Presence Protocol (XMPP). If aPidgin client initiates a file transfer, and the remote target sends amalformed response, it could cause Pidgin to crash or, potentially, executearbitrary code with the permissions of the user running Pidgin. This flawonly affects accounts using XMPP, such as Jabber and Google Talk.(CVE-2009-1373)It was discovered that on 32-bit platforms, the Red Hat Security AdvisoryRHSA-2008:0584 provided an incomplete fix for the integer overflow flawaffecting Pidgin's MSN protocol handler. If a Pidgin client receives aspecially-crafted MSN message, it may be possible to execute arbitrary codewith the permissions of the user running Pidgin. (CVE-2009-1376)Note: By default, when using an MSN account, only users on your buddy listcan send you messages. This prevents arbitrary MSN users from exploitingthis flaw.All Pidgin users should upgrade to this update package, which containsbackported patches to resolve these issues. Pidgin must be restarted forthis update to take effect.