Ubuntu 12.10 USN-1746-1 Critical: Pidgin Multiple Issues Fixed

ubuntu

February 25, 2013

Several security issues were fixed in Pidgin.

Summary

Several security issues were fixed in Pidgin.

Software Description:

- pidgin: graphical multi-protocol instant messaging client for X

Details:

Chris Wysopal discovered that Pidgin incorrectly handled file transfers in

the MXit protocol handler. A remote attacker could use this issue to create

or overwrite arbitrary files. This issue only affected Ubuntu 11.10,

Ubuntu 12.04 LTS and Ubuntu 12.10. (CVE-2013-0271)

It was discovered that Pidgin incorrectly handled long HTTP headers in the

MXit protocol handler. A malicious remote server could use this issue to

execute arbitrary code. (CVE-2013-0272)

It was discovered that Pidgin incorrectly handled long user IDs in the

Sametime protocol handler. A malicious remote server could use this issue

to cause Pidgin to crash, resulting in a denial of service. (CVE-2013-0273)

It was discovered that Pidgin incorrectly handled long strings when

processing UPnP responses. A remote attacker could use this issue to cause

P...

Read the Full Advisory

Topics Covered

security advisory denial of service critical remote code execution ubuntu pidgin file transfer issue

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 12.10:
  libpurple0                      1:2.10.6-0ubuntu2.2
  pidgin                          1:2.10.6-0ubuntu2.2

Ubuntu 12.04 LTS:
  libpurple0                      1:2.10.3-0ubuntu1.3
  pidgin                          1:2.10.3-0ubuntu1.3

Ubuntu 11.10:
  libpurple0                      1:2.10.0-0ubuntu2.2
  pidgin                          1:2.10.0-0ubuntu2.2

Ubuntu 10.04 LTS:
  libpurple0                      1:2.6.6-1ubuntu4.6
  pidgin                          1:2.6.6-1ubuntu4.6

After a standard system update you need to restart Pidgin to make all the
necessary changes.