Date:         Fri, 19 Feb 2010 13:52:41 -0600
Reply-To:     Troy Dawson 
Sender:       Security Errata for Scientific Linux
              
From:         Troy Dawson 
Subject:      Security ERRATA Moderate: pidgin on SL4.x, SL5.x i386/x86_64
Comments: To: "scientific-linux-errata@fnal.gov"
          

Synopsis:	Moderate: pidgin security update
Issue date:	2010-02-18
CVE Names:	CVE-2010-0277 CVE-2010-0420 CVE-2010-0423

CVE-2010-0277 pidgin MSN protocol plugin memory corruption
CVE-2010-0420 pidgin: Finch XMPP MUC Crash
CVE-2010-0423 pidgin: Smiley Denial of Service

An input sanitization flaw was found in the way Pidgin's MSN protocol
implementation handled MSNSLP invitations. A remote attacker could send 
a specially-crafted INVITE request that would cause a denial of service
(memory corruption and Pidgin crash). (CVE-2010-0277)

A denial of service flaw was found in Finch's XMPP chat implementation,
when using multi-user chat. If a Finch user in a multi-user chat session
were to change their nickname to contain the HTML "br" element, it would
cause Finch to crash. (CVE-2010-0420)

A denial of service flaw was found in the way Pidgin processed emoticon
images. A remote attacker could flood the victim with emoticon images
during mutual communication, leading to excessive CPU use. (CVE-2010-0423)

Pidgin must be restarted for this update to take effect.

SL 4.x

      SRPMS:
pidgin-2.6.6-1.el4.src.rpm
      i386:
finch-2.6.6-1.el4.i386.rpm
finch-devel-2.6.6-1.el4.i386.rpm
libpurple-2.6.6-1.el4.i386.rpm
libpurple-devel-2.6.6-1.el4.i386.rpm
libpurple-perl-2.6.6-1.el4.i386.rpm
libpurple-tcl-2.6.6-1.el4.i386.rpm
pidgin-2.6.6-1.el4.i386.rpm
pidgin-devel-2.6.6-1.el4.i386.rpm
pidgin-perl-2.6.6-1.el4.i386.rpm
      x86_64:
finch-2.6.6-1.el4.x86_64.rpm
finch-devel-2.6.6-1.el4.x86_64.rpm
libpurple-2.6.6-1.el4.x86_64.rpm
libpurple-devel-2.6.6-1.el4.x86_64.rpm
libpurple-perl-2.6.6-1.el4.x86_64.rpm
libpurple-tcl-2.6.6-1.el4.x86_64.rpm
pidgin-2.6.6-1.el4.x86_64.rpm
pidgin-devel-2.6.6-1.el4.x86_64.rpm
pidgin-perl-2.6.6-1.el4.x86_64.rpm

SL 5.x

      SRPMS:
pidgin-2.6.6-1.el5.src.rpm
      i386:
finch-2.6.6-1.el5.i386.rpm
finch-devel-2.6.6-1.el5.i386.rpm
libpurple-2.6.6-1.el5.i386.rpm
libpurple-devel-2.6.6-1.el5.i386.rpm
libpurple-perl-2.6.6-1.el5.i386.rpm
libpurple-tcl-2.6.6-1.el5.i386.rpm
pidgin-2.6.6-1.el5.i386.rpm
pidgin-devel-2.6.6-1.el5.i386.rpm
pidgin-perl-2.6.6-1.el5.i386.rpm
      x86_64:
finch-2.6.6-1.el5.i386.rpm
finch-2.6.6-1.el5.x86_64.rpm
finch-devel-2.6.6-1.el5.i386.rpm
finch-devel-2.6.6-1.el5.x86_64.rpm
libpurple-2.6.6-1.el5.i386.rpm
libpurple-2.6.6-1.el5.x86_64.rpm
libpurple-devel-2.6.6-1.el5.i386.rpm
libpurple-devel-2.6.6-1.el5.x86_64.rpm
libpurple-perl-2.6.6-1.el5.x86_64.rpm
libpurple-tcl-2.6.6-1.el5.x86_64.rpm
pidgin-2.6.6-1.el5.i386.rpm
pidgin-2.6.6-1.el5.x86_64.rpm
pidgin-devel-2.6.6-1.el5.i386.rpm
pidgin-devel-2.6.6-1.el5.x86_64.rpm
pidgin-perl-2.6.6-1.el5.x86_64.rpm

-Connie Sieh
-Troy Dawson

SciLinux: CVE-2010-0277 Moderate: pidgin SL4.x, SL5.x i386/x86_64

Moderate: pidgin security update

Summary

CVE-2010-0423 pidgin: Smiley Denial of ServiceAn input sanitization flaw was found in the way Pidgin's MSN protocolimplementation handled MSNSLP invitations. A remote attacker could senda specially-crafted INVITE request that would cause a denial of service(memory corruption and Pidgin crash). (CVE-2010-0277)A denial of service flaw was found in Finch's XMPP chat implementation,when using multi-user chat. If a Finch user in a multi-user chat sessionwere to change their nickname to contain the HTML "br" element, it wouldcause Finch to crash. (CVE-2010-0420)A denial of service flaw was found in the way Pidgin processed emoticonimages. A remote attacker could flood the victim with emoticon imagesduring mutual communication, leading to excessive CPU use. (CVE-2010-0423)Pidgin must be restarted for this update to take effect.



Security Fixes

Severity
Issued Date: : 2010-02-18
CVE Names: CVE-2010-0277 CVE-2010-0420 CVE-2010-0423
CVE-2010-0277 pidgin MSN protocol plugin memory corruption
CVE-2010-0420 pidgin: Finch XMPP MUC Crash

Related News

19.Laptop Bed Esm H320
2 - 3 min read
The release of Google Chrome 124 addresses four vulnerabilities, including a critical security flaw that can enable attackers to execute arbitrary
23.Tablet Connections Esm H320
2 - 3 min read
The release of Ubuntu 24.04 LTS , also known as Noble Numbat, brings various security enhancements and exciting new features . These improvements
4.Lock AbstractDigital Esm H320
2 - 3 min read
Tails 6.2 is a new Linux distribution release that expands its multilingual support and improves security features. The distribution is a
19.Laptop Bed Esm H320
2 - 3 min read
AlmaLinux 9.4 beta has been released and provides compelling reasons to consider it for desktop usage. While AlmaLinux is primarily known as a
32.Lock Code Circular Esm H320
2 - 3 min read
Linux admins and security practitioners face significant challenges in keeping their Linux systems secure amidst the constant threat of kernel bugs.
1.Penguin Landscape Esm H320
2 - 3 min read
A significant security threat, known as the Spectre v2 exploit, has been observed targeting Linux systems running on modern Intel processors. Let's
10.FingerPrint Locks Esm H320
2 - 3 min read
The recent release of I2P 2.5.0 , an anonymous P2P network that protects against online censorship, surveillance, and monitoring, has brought a slew
24.Key Code Esm H320
2 - 3 min read
The Akira ransomware group has extorted approximately $42 million from over 250 victims since January 1, 2024. The group initially focused on
Sign Up

Get the Latest News & Insights

Sign up to get the latest security news affecting Linux and open source delivered straight to your inbox.

© 2024 Guardian Digital, Inc All Rights Reserved