Date:         Mon, 2 Nov 2009 13:35:33 -0600
Reply-To:     Troy Dawson 
Sender:       Security Errata for Scientific Linux
              
From:         Troy Dawson 
Subject:      Security ERRATA Moderate: pidgin on SL3.x, SL4.x,
              SL5.x i386/x86_64
Comments: To: "scientific-linux-errata@fnal.gov"
          

Synopsis:	Moderate: pidgin security update
Issue date:	2009-10-29
CVE Names:	CVE-2009-2703 CVE-2009-3083 CVE-2009-3615

An invalid pointer dereference bug was found in the way the Pidgin OSCAR
protocol implementation processed lists of contacts. A remote attacker
could send a specially-crafted contact list to a user running Pidgin,
causing Pidgin to crash. (CVE-2009-3615)

A NULL pointer dereference flaw was found in the way the Pidgin IRC
protocol plug-in handles IRC topics. A malicious IRC server could send a
specially-crafted IRC TOPIC message, which once received by Pidgin, 
would lead to a denial of service (Pidgin crash). (CVE-2009-2703) - SL3 only

A NULL pointer dereference flaw was found in the way the Pidgin MSN
protocol plug-in handles improper MSNSLP invitations. A remote attacker
could send a specially-crafted MSNSLP invitation request, which once
accepted by a valid Pidgin user, would lead to a denial of service 
(Pidgin crash). (CVE-2009-3083) - SL3 only

Pidgin must be restarted for this update to take effect.

SL 3.0.x

       SRPMS:
pidgin-1.5.1-6.el3.src.rpm
       i386:
pidgin-1.5.1-6.el3.i386.rpm
       x86_64:
pidgin-1.5.1-6.el3.x86_64.rpm

SL 4.x

       SRPMS:
pidgin-2.6.3-2.el4.src.rpm
       i386:
finch-2.6.3-2.el4.i386.rpm
finch-devel-2.6.3-2.el4.i386.rpm
libpurple-2.6.3-2.el4.i386.rpm
libpurple-devel-2.6.3-2.el4.i386.rpm
libpurple-perl-2.6.3-2.el4.i386.rpm
libpurple-tcl-2.6.3-2.el4.i386.rpm
pidgin-2.6.3-2.el4.i386.rpm
pidgin-devel-2.6.3-2.el4.i386.rpm
pidgin-perl-2.6.3-2.el4.i386.rpm
       x86_64:
finch-2.6.3-2.el4.x86_64.rpm
finch-devel-2.6.3-2.el4.x86_64.rpm
libpurple-2.6.3-2.el4.x86_64.rpm
libpurple-devel-2.6.3-2.el4.x86_64.rpm
libpurple-perl-2.6.3-2.el4.x86_64.rpm
libpurple-tcl-2.6.3-2.el4.x86_64.rpm
pidgin-2.6.3-2.el4.x86_64.rpm
pidgin-devel-2.6.3-2.el4.x86_64.rpm
pidgin-perl-2.6.3-2.el4.x86_64.rpm

SL 5.x

       SRPMS:
pidgin-2.6.3-2.el5.src.rpm
       i386:
finch-2.6.3-2.el5.i386.rpm
finch-devel-2.6.3-2.el5.i386.rpm
libpurple-2.6.3-2.el5.i386.rpm
libpurple-devel-2.6.3-2.el5.i386.rpm
libpurple-perl-2.6.3-2.el5.i386.rpm
libpurple-tcl-2.6.3-2.el5.i386.rpm
pidgin-2.6.3-2.el5.i386.rpm
pidgin-devel-2.6.3-2.el5.i386.rpm
pidgin-perl-2.6.3-2.el5.i386.rpm
       x86_64:
finch-2.6.3-2.el5.i386.rpm
finch-2.6.3-2.el5.x86_64.rpm
finch-devel-2.6.3-2.el5.i386.rpm
finch-devel-2.6.3-2.el5.x86_64.rpm
libpurple-2.6.3-2.el5.i386.rpm
libpurple-2.6.3-2.el5.x86_64.rpm
libpurple-devel-2.6.3-2.el5.i386.rpm
libpurple-devel-2.6.3-2.el5.x86_64.rpm
libpurple-perl-2.6.3-2.el5.x86_64.rpm
libpurple-tcl-2.6.3-2.el5.x86_64.rpm
pidgin-2.6.3-2.el5.i386.rpm
pidgin-2.6.3-2.el5.x86_64.rpm
pidgin-devel-2.6.3-2.el5.i386.rpm
pidgin-devel-2.6.3-2.el5.x86_64.rpm
pidgin-perl-2.6.3-2.el5.x86_64.rpm

-Connie Sieh
-Troy Dawson