RHSA-2009:1060: Important: pidgin security update

First published: Fri May 22 2009(Updated: )

Pidgin is an instant messaging program which can log in to multiple<br>accounts on multiple instant messaging networks simultaneously.<br>A buffer overflow flaw was found in the way Pidgin initiates file transfers<br>when using the Extensible Messaging and Presence Protocol (XMPP). If a<br>Pidgin client initiates a file transfer, and the remote target sends a<br>malformed response, it could cause Pidgin to crash or, potentially, execute<br>arbitrary code with the permissions of the user running Pidgin. This flaw<br>only affects accounts using XMPP, such as Jabber and Google Talk.<br>(CVE-2009-1373)<br>A denial of service flaw was found in Pidgin's QQ protocol decryption<br>handler. When the QQ protocol decrypts packet information, heap data can be<br>overwritten, possibly causing Pidgin to crash. (CVE-2009-1374)<br>A flaw was found in the way Pidgin's PurpleCircBuffer object is expanded.<br>If the buffer is full when more data arrives, the data stored in this<br>buffer becomes corrupted. This corrupted data could result in confusing or<br>misleading data being presented to the user, or possibly crash Pidgin.<br>(CVE-2009-1375)<br>It was discovered that on 32-bit platforms, the Red Hat Security Advisory<br>RHSA-2008:0584 provided an incomplete fix for the integer overflow flaw<br>affecting Pidgin's MSN protocol handler. If a Pidgin client receives a<br>specially-crafted MSN message, it may be possible to execute arbitrary code<br>with the permissions of the user running Pidgin. (CVE-2009-1376)<br>Note: By default, when using an MSN account, only users on your buddy list<br>can send you messages. This prevents arbitrary MSN users from exploiting<br>this flaw.<br>All Pidgin users should upgrade to these updated packages, which contain<br>backported patches to resolve these issues. Pidgin must be restarted for<br>this update to take effect.

Never miss a vulnerability like this again

Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.

Read MoreStart Free Trial

• agent/description
• agent/event
• agent/first-publish-date
• agent/last-modified-date
• agent/references
• agent/remedy
• agent/severity
• agent/softwarecombine
• agent/tags
• agent/title
• agent/type
• agent/weakness
• collector/redhat-errata
• source/Red Hat
• anchor-id/RHSA-2009:1060
• agent/software-canonical-lookup
• package-manager/redhat