RHSA-2009:1059: Important: pidgin security update
First published: Fri May 22 2009(Updated: )
Pidgin is an instant messaging program which can log in to multiple<br>accounts on multiple instant messaging networks simultaneously.<br>A buffer overflow flaw was found in the way Pidgin initiates file transfers<br>when using the Extensible Messaging and Presence Protocol (XMPP). If a<br>Pidgin client initiates a file transfer, and the remote target sends a<br>malformed response, it could cause Pidgin to crash or, potentially, execute<br>arbitrary code with the permissions of the user running Pidgin. This flaw<br>only affects accounts using XMPP, such as Jabber and Google Talk.<br>(CVE-2009-1373)<br>It was discovered that on 32-bit platforms, the Red Hat Security Advisory<br>RHSA-2008:0584 provided an incomplete fix for the integer overflow flaw<br>affecting Pidgin's MSN protocol handler. If a Pidgin client receives a<br>specially-crafted MSN message, it may be possible to execute arbitrary code<br>with the permissions of the user running Pidgin. (CVE-2009-1376)<br>Note: By default, when using an MSN account, only users on your buddy list<br>can send you messages. This prevents arbitrary MSN users from exploiting<br>this flaw.<br>All Pidgin users should upgrade to this update package, which contains<br>backported patches to resolve these issues. Pidgin must be restarted for<br>this update to take effect.
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Pidgin |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of RHSA-2009:1059?
The severity of RHSA-2009:1059 is classified as important.
How do I fix RHSA-2009:1059?
To fix RHSA-2009:1059, update Pidgin to the latest version available in your distribution.
What is the impact of RHSA-2009:1059?
The impact of RHSA-2009:1059 includes the potential for a remote attacker to execute arbitrary code via crafted file transfers.
What versions of Pidgin are affected by RHSA-2009:1059?
RHSA-2009:1059 affects specific versions of Pidgin that utilize the XMPP protocol for file transfers.
Is there a workaround for RHSA-2009:1059?
A possible workaround for RHSA-2009:1059 is to disable file transfers in Pidgin until the patch is applied.
- agent/references
- agent/weakness
- agent/severity
- agent/type
- agent/event
- agent/first-publish-date
- agent/last-modified-date
- collector/redhat-errata
- source/Red Hat
- anchor-id/RHSA-2009:1059
- agent/remedy
- agent/title
- agent/description
- agent/trending
- agent/source
- agent/softwarecombine
- agent/tags
- agent/guess-ai
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- vendor/pidgin
- canonical/pidgin