USN-1014-1: Pidgin vulnerabilities

Releases

• Ubuntu 10.10
• Ubuntu 10.04
• Ubuntu 9.10
• Ubuntu 8.04

Packages

• pidgin -

Details

Pierre Noguès discovered that Pidgin incorrectly handled malformed SLP
messages in the MSN protocol handler. A remote attacker could send a
specially crafted message and cause Pidgin to crash, leading to a denial
of service. This issue only affected Ubuntu 8.04 LTS, 9.10 and 10.04 LTS.
(CVE-2010-1624)

Daniel Atallah discovered that Pidgin incorrectly handled the return code
of the Base64 decoding function. A remote attacker could send a specially
crafted message and cause Pidgin to crash, leading to a denial of service.
(CVE-2010-3711)

Update instructions

The problem can be corrected by updating your system to the following package versions:

Ubuntu 9.10

• pidgin - 1:2.6.2-1ubuntu7.3

Ubuntu 8.04

• pidgin - 1:2.4.1-1ubuntu2.10

Ubuntu 10.10

• pidgin - 1:2.7.3-1ubuntu3.1

Ubuntu 10.04

• pidgin - 1:2.6.6-1ubuntu4.1

After a standard system update you need to restart Pidgin to make all the
necessary changes.

References

• CVE-2010-1624
• CVE-2010-3711