Explore top 10 tips to secure your open-source projects now. Read More

×
Alerts This Week
Warning Icon 1 536
Alerts This Week
Warning Icon 1 536

Ubuntu 14.10, 14.04, 12.04 LTS: Pidgin Security Fix USN-2390-1

ubuntu
Calendar Grey October 28, 2014
Scroller Ubuntu
Alert issued regarding Pidgin weaknesses impacting various Ubuntu releases; suggestions offered for risk reduction.
Several security issues were fixed in Pidgin.

Summary

Several security issues were fixed in Pidgin.

Software Description:

- pidgin: graphical multi-protocol instant messaging client for X

Details:

Jacob Appelbaum and an anonymous person discovered that Pidgin incorrectly

handled certificate validation. A remote attacker could exploit this to

perform a man in the middle attack to view sensitive information or alter

encrypted communications. (CVE-2014-3694)

Yves Younan and Richard Johnson discovered that Pidgin incorrectly handled

certain malformed MXit emoticons. A malicious remote server or a man in the

middle could use this issue to cause Pidgin to crash, resulting in a denial

of service. (CVE-2014-3695)

Yves Younan and Richard Johnson discovered that Pidgin incorrectly handled

certain malformed Groupwise messages. A malicious remote server or a man in

the middle could use this issue to cause Pidgin to crash, resulting in a

denial of service. (CVE-2014-3696)

Thijs Alkemade and Paul Aurich discovered that ...

Read the Full Advisory

Topics%20covered

Topics Covered

security advisory information leak remote access DoS Ubuntu certificate validation Pidgin

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 14.10:
  libpurple0                      1:2.10.9-0ubuntu7.1
  pidgin                          1:2.10.9-0ubuntu7.1

Ubuntu 14.04 LTS:
  libpurple0                      1:2.10.9-0ubuntu3.2
  pidgin                          1:2.10.9-0ubuntu3.2

Ubuntu 12.04 LTS:
  libpurple0                      1:2.10.3-0ubuntu1.6
  pidgin                          1:2.10.3-0ubuntu1.6

After a standard system update you need to restart Pidgin to make all the
necessary changes.

References

https://ubuntu.com/security/notices/USN-2390-1

CVE-2014-3694, CVE-2014-3695, CVE-2014-3696, CVE-2014-3698

Severity
important
Lowest
Low
Medium
High
Critical

October 28, 2014

Topics%20covered

Topics Covered

security advisory information leak remote access DoS Ubuntu certificate validation Pidgin

Package Information

https://launchpad.net/ubuntu/+source/pidgin/1:2.10.9-0ubuntu7.1
https://launchpad.net/ubuntu/+source/pidgin/1:2.10.9-0ubuntu3.2
https://launchpad.net/ubuntu/+source/pidgin/1:2.10.3-0ubuntu1.6

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.