Stay Secure with the Latest Linux Advisories
Refine advisories
X Clear Filters
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
What got you started with Linux?
Loading...
Explore Latest Linux Security advisories
We found -5 articles for you...
198
security advisoryhigh severitycode executionArch Linux: ASA-201703-18 High Severity: Libpurple Code Execution Risk
The package libpurple before version 2.12.0-1 is vulnerable to arbitrary code execution. . Arch Linux Security Advisory ASA-201703-18 ========================================= Severity: High Date : 2017-03-21 CVE-ID : CVE-2017-2640 Package : libpurple Type : arbitrary code execution Remote : Yes Link : https://security.archlinux.org/AVG-226 Summary ====== The package libpurple before version 2.12.0-1 is vulnerable to arbitrary code execution. Resolution ========= Upgrade to 2.12.0-1. # pacman -Syu "libpurple> =2.12.0-1" The problem has been fixed upstream in version 2.12.0. Workaround ========= None. Description ========== An out-of-bounds write has been found in libpurple < 2.12.0 in the purple_markup_unescape_entity function. This issue can be triggered by a malicious server sending invalid XML entities separated by whitespace, eg "ஸ" to the client. Impact ===== A remote attacker is able to execute arbitrary code on the affected host if it connects to a malicious server. References ========= https://seclists.org/fulldisclosure/2017/Mar/57 https://security.archlinux.org/CVE-2017-2640 . The CentOS Security Alert SA-2023-50 underscores a critical vulnerability in libpurple that poses a significant execution threat, necessitating immediate updates.. Arch Linux, libpurple, code execution, security advisory. . LinuxSecurity.com Team
Mar 23, 2017
ArchLinux
198
security advisorydenial of serviceinformation leakArchLinux: 201606-24 Critical: Libpurple Code Execution Risk
The package libpurple before version 2.11.0-1 is vulnerable to multiple issues including information leakage, denial of service, directory traversal and arbitrary code execution. . Arch Linux Security Advisory ASA-201606-24 ========================================= Severity: Critical Date : 2016-06-25 CVE-ID : CVE-2016-2365 CVE-2016-2366 CVE-2016-2367 CVE-2016-2368 CVE-2016-2369 CVE-2016-2370 CVE-2016-2371 CVE-2016-2372 CVE-2016-2373 CVE-2016-2374 CVE-2016-2375 CVE-2016-2376 CVE-2016-2377 CVE-2016-2378 CVE-2016-2380 CVE-2016-4323 Package : libpurple Type : multiple issues Remote : Yes Link : https://wiki.archlinux.org/title/CVE Summary ====== The package libpurple before version 2.11.0-1 is vulnerable to multiple issues including information leakage, denial of service, directory traversal and arbitrary code execution. Resolution ========= Upgrade to 2.11.0-1. # pacman -Syu "libpurple> =2.11.0-1" The problems have been fixed upstream in version 2.11.0. Workaround ========= All flaws have been found in the support for the MXit protocol. Therefore libpurple is only vulnerable when this protocol is used, so disabling MXit accounts until the package can be upgraded should be enough. Description ========== - CVE-2016-2365 (denial of service) Specially crafted MXIT data sent via the server could potentially result in a null pointer dereference. - CVE-2016-2366 (denial of service) Specially crafted MXIT data sent via the server could potentially result in an out-of-bounds read. - CVE-2016-2367 (information leakage, denial of service) Specially crafted MXIT data sent via the server could potentially result in an out of bounds read. This issue can also potentially leak sensitive information from memory into the data after the avatar which can then be transferred when the avatar is copied. - CVE-2016-2368 (arbitrary code execution) Specially crafted MXIT data sent via the server could potentially result in abuffer overflow. The MXIT plugin for Pidgin uses the function g_snprintf() in about 27 places where it receives the return value of the function. When g_snprintf() returns, it will return the number of bytes that would have been written had the buffer been large enough, not the amount of bytes that have actually been written. The MXIT plugin uses the return value of g_snprintf() as an index or an offset into the string that is being manipulated in multiple locations without making sure that the return value is within bounds. - CVE-2016-2369 (denial of service) Specially crafted MXIT data sent via the server could potentially result in a NULL pointer dereference. - CVE-2016-2370 (denial of service) Specially crafted MXIT data sent via the server could potentially result in an out-of-bounds read. - CVE-2016-2371 (arbitrary code execution) Specially crafted MXIT data sent via the server could potentially result in a buffer overflow. The function mxit_parse_cmd_extprofile() is called when extended profile packets are received from the server. A malicious server, an attacker who intercepts the network traffic or a potentially malicious user (if the data is not validated by the server) can send an invalid number of records, which could result in an out-of-bounds write of data. - CVE-2016-2372 (information leakage, denial of service) Specially crafted MXIT data sent via the server could potentially result in an out-of-bounds read. This issue can also potentially leak sensitive information by appending sensitive information from memory to the end of a received file. - CVE-2016-2373 (denial of service) Specially crafted MXIT data sent via the server could potentially result in an out-of-bounds read. A malicious server or user can send an invalid mood to trigger this vulnerability. - CVE-2016-2374 (arbitrary code execution) Specially crafted MXIT MultiMX message sent via the server can result in an out-of-bounds write leading to memory disclosure and codeexecution. - CVE-2016-2375 (information leakage) Specially crafted MXIT data sent from the server could potentially result in an out-of-bounds read. In the function mxit_parse_cmd_suggestcontacts() in the file mxit/protocol.c at line 2020 the number of attributes will be read from the incoming packet into the variable count. - CVE-2016-2376 (arbitrary code execution) Specially crafted MXIT data sent from the server could potentially result in a buffer overflow. The function mxit_cb_rx in the file mxit/protocol.c is a callback function will be called by Pidgin whenever data is sent from the MXIT server. When data is received, the size of the incoming packet will also be received at line 2825. There is a check at line 2826 to ensure that this data isn't larger than the maximum size of that an MXIT packet can be which is defined as CP_MAX_PACKET. This is also the size of the buffer that the data is read into. However if the size is larger than CP_MAX_PACKET, an error will be logged but execution will simply continue. Moreover, if the size is negative (this is possible since rx_res is an int) then no error will be logged and execution will also continue. - CVE-2016-2377 (arbitrary code execution) Specially crafted MXIT data sent by the server could potentially result in an out of bounds write of one byte. - CVE-2016-2378 (arbitrary code execution) Specially crafted data sent via the server could potentially result in a buffer overflow, potentially resulting in memory corruption. - CVE-2016-2380 (information leakage) Specially crafted MXIT data sent to the server could potentially result in an out of bounds read. A user could be convinced to enter a particular string which would then get converted incorrectly and could lead to a potential out-of-bounds read. - CVE-2016-4323 (directory traversal) Specially crafted MXIT data sent from the server could potentially result in an overwrite of files. A malicious server or someone with access to the network trafficcan provide an invalid filename for a splash image triggering the vulnerability. Impact ===== A remote attacker might be able to access sensitive information, cause a denial of service or execute arbitrary code on the affected host. References ========= https://blog.talosintelligence.com/vulnerability-spotlight-pidgin/ https://access.redhat.com/security/cve/CVE-2016-2365 https://access.redhat.com/security/cve/CVE-2016-2366 https://access.redhat.com/security/cve/CVE-2016-2367 https://access.redhat.com/security/cve/CVE-2016-2368 https://access.redhat.com/security/cve/CVE-2016-2369 https://access.redhat.com/security/cve/CVE-2016-2370 https://access.redhat.com/security/cve/CVE-2016-2371 https://access.redhat.com/security/cve/CVE-2016-2372 https://access.redhat.com/security/cve/CVE-2016-2373 https://access.redhat.com/security/cve/CVE-2016-2374 https://access.redhat.com/security/cve/CVE-2016-2375 https://access.redhat.com/security/cve/CVE-2016-2376 https://access.redhat.com/security/cve/CVE-2016-2377 https://access.redhat.com/security/cve/CVE-2016-2378 https://access.redhat.com/security/cve/CVE-2016-2380 https://access.redhat.com/security/cve/CVE-2016-4323 . Critical advisory for ArchLinux users: vulnerabilities in libpurple require immediate action. Update your package to ensure system stability and security. libpurple issues, archlinux security, critical advisories. . Severity: Critical. LinuxSecurity.com Team
Jun 25, 2016
•Critical
ArchLinux
198
security advisoryhigh severityinformation leakArch Linux: ASA-201410-9 High: libpurple Remote DoS And Info Leak
The package libpurple before version 2.10.10-1 is vulnerable to a remote denial of service and remote information leakage. . Arch Linux Security Advisory ASA-201410-9 ======================================== Severity: High Date : 2014-10-22 CVE-ID : CVE-2014-3695, CVE-2014-3696, CVE-2014-3698 Package : libpurple Type : Remote denial of service, Information leakage Remote : Yes Link : https://wiki.archlinux.org/title/CVE-2014 Summary ====== The package libpurple before version 2.10.10-1 is vulnerable to a remote denial of service and remote information leakage. Resolution ========= Upgrade to 2.10.10-1. # pacman -Syu "libpurple> =2.10.10-1" The problem has been fixed upstream in version 2.10.10. Workaround ========= None. Description ========== A malicious server and possibly even a malicious remote user could create a carefully crafted XMPP message that causes libpurple to send an XMPP message containing arbitrary memory. A malicious server or man-in-the-middle could trigger a crash in libpurple by sending an emoticon via MXit with an overly large length value. A malicious server or man-in-the-middle could trigger a crash in libpurple by specifying that a large amount of memory should be allocated in a Novell Groupwise message. Impact ===== A remote attacker could access arbitrary memory from any application using libpurple via a specially crafted XMPP message. A remote attacker in position of man-in-the-middle, or a malicious server, could remotely crash any application using libpurple via a MXit or Novell Groupwise message. References ========= http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-3695 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-3696 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-3698 . Critical urgency Debian Linux security alert regarding libpurple flaw impacting external services and data integrity.. Arch Linux, libpurple, remote access, DoS attack, information theft. . LinuxSecurity.comTeam
Oct 22, 2014
ArchLinux
100
security advisoryimportantSUSESUSE: 2012:0782-1 Important: Pidgin Remote Triggering Crashes Fixed
An update that contains security fixes can now be installed. An update that contains security fixes can now be installed. An update that contains security fixes can now be installed.. SUSE Security Update: Security update for finch, libpurple and pidgin ______________________________________________________________________________ Announcement ID: SUSE-SU-2012:0782-1 Rating: important References: #752275 #760890 #761155 Affected Products: SUSE Linux Enterprise Software Development Kit 11 SP2 SUSE Linux Enterprise Software Development Kit 11 SP1 SUSE Linux Enterprise Desktop 11 SP2 SUSE Linux Enterprise Desktop 11 SP1 SUSE Linux Enterprise Desktop 10 SP4 SLE SDK 10 SP4 ______________________________________________________________________________ An update that contains security fixes can now be installed. Description: Various remote triggerable crashes in pidgin have been fixed: * CVE-2012-1178: In some situations the MSN server sends text that isn't UTF-8 encoded, and Pidgin fails to verify the text's encoding. In some cases this can lead to a crash when attempting to display the text (). * CVE-2012-1178/CVE-2012-2318: Incoming messages with certain characters or character encodings can cause clients to crash. * CVE-2012-2214: A series of specially crafted file transfer requests can cause clients to reference invalid memory. The user must have accepted one of the file transfer requests. Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Software Development Kit 11 SP2: zypper in -t patch sdksp1-finch-6294 - SUSE Linux Enterprise Software Development Kit 11 SP1: zypper in -t patch sdksp1-finch-6294 - SUSE Linux Enterprise Desktop 11 SP2: zypper in -t patchsledsp1-finch-6294 - SUSE Linux Enterprise Desktop 11 SP1: zypper in -t patch sledsp1-finch-6294 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Software Development Kit 11 SP2 (i586 ia64 ppc64 s390x x86_64): finch-2.6.6-0.15.1 finch-devel-2.6.6-0.15.1 libpurple-2.6.6-0.15.1 libpurple-devel-2.6.6-0.15.1 libpurple-lang-2.6.6-0.15.1 pidgin-2.6.6-0.15.1 pidgin-devel-2.6.6-0.15.1 - SUSE Linux Enterprise Software Development Kit 11 SP1 (i586 ia64 ppc64 s390x x86_64): finch-2.6.6-0.15.1 finch-devel-2.6.6-0.15.1 libpurple-2.6.6-0.15.1 libpurple-devel-2.6.6-0.15.1 libpurple-lang-2.6.6-0.15.1 pidgin-2.6.6-0.15.1 pidgin-devel-2.6.6-0.15.1 - SUSE Linux Enterprise Desktop 11 SP2 (i586 x86_64): finch-2.6.6-0.15.1 libpurple-2.6.6-0.15.1 libpurple-lang-2.6.6-0.15.1 libpurple-meanwhile-2.6.6-0.15.1 libpurple-tcl-2.6.6-0.15.1 pidgin-2.6.6-0.15.1 - SUSE Linux Enterprise Desktop 11 SP1 (i586 x86_64): finch-2.6.6-0.15.1 libpurple-2.6.6-0.15.1 libpurple-lang-2.6.6-0.15.1 libpurple-meanwhile-2.6.6-0.15.1 libpurple-tcl-2.6.6-0.15.1 pidgin-2.6.6-0.15.1 - SUSE Linux Enterprise Desktop 10 SP4 (i586 x86_64): finch-2.6.6-0.16.1 libpurple-2.6.6-0.16.1 pidgin-2.6.6-0.16.1 - SLE SDK 10 SP4 (i586 ia64 ppc s390x x86_64): finch-2.6.6-0.16.1 finch-devel-2.6.6-0.16.1 libpurple-2.6.6-0.16.1 libpurple-devel-2.6.6-0.16.1 pidgin-2.6.6-0.16.1 pidgin-devel-2.6.6-0.16.1 References: . Critical patch released for finch, libpurple, and pidgin fixing remote-triggered crash vulnerabilities. Update immediately.. SUSE Linux, Pidgin Update, Finch Security, Libpurple Patch, SUSE Security. . Severity: Important. LinuxSecurity.com Team
Jun 22, 2012
•Important
SuSE
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
What got you started with Linux?
Search Topics
Powered By
Linux Security - Your source for Top Linux News, Advisories, HOWTOs and Feature Releases
QUICK LINKS
subscribe to newsletters!
Like staying secure? So do we.
Sign up for updates, tips, and alerts!