Multiple vulnerabilities in Pidgin
Summary
DSA-2859-1: pidgin - several. Affects pidgin versions < 2.10.9-1~deb7u1. Fixed in 2.10.9-1~deb7u1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Pidgin is a multi-protocol instant messaging client that allows users to connect to multiple chat networks simultaneously. It supports various protocols such as XMPP, IRC, Gadu-Gadu, and MXit. Pidgin is widely used for its cross-platform compatibility and extensive plugin support. However, several vulnerabilities have been discovered in Pidgin, which could potentially lead to crashes, denial of service, and buffer overflows.
Vulnerability Detail
The vulnerabilities in Pidgin include:
- CVE-2013-6477: A remote XMPP user can crash Pidgin by sending a message with a timestamp in the distant future.
- CVE-2013-6478: Pidgin can be crashed through overly wide tooltip windows.
- CVE-2013-6479: A malicious server or a man-in-the-middle can send a malformed HTTP header, resulting in denial of service.
- CVE-2013-6481: Pidgin can be crashed through malformed Yahoo! P2P messages.
- CVE-2013-6482: Pidgin can be crashed through malformed MSN messages.
- CVE-2013-6483: Pidgin can be crashed through malformed XMPP messages.
- CVE-2013-6484: Incorrect error handling when reading the response from a STUN server can result in a crash.
- CVE-2013-6485: A buffer overflow can occur in the parsing of malformed HTTP responses.
- CVE-2013-6487: A buffer overflow can occur when parsing Gadu-Gadu messages.
- CVE-2013-6489: An integer overflow can occur when parsing MXit emoticons.
- CVE-2013-6490: A buffer overflow can occur when parsing SIMPLE headers.
- CVE-2014-0020: Pidgin can be crashed via malformed IRC arguments.
These vulnerabilities can be exploited by remote attackers to crash Pidgin or execute arbitrary code, potentially compromising the security and stability of the system.
How To Fix
Minimum fixed version
2.10.9-1~deb7u1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade pidginTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There are no specific workarounds mentioned for these vulnerabilities. It is crucial to apply the recommended fix by upgrading Pidgin to the latest version.
Conclusion
Multiple vulnerabilities have been discovered in Pidgin, a multi-protocol instant messaging client. These vulnerabilities can be exploited by remote attackers to crash Pidgin or execute arbitrary code. It is crucial to upgrade Pidgin to version 2.10.9-1 or later to mitigate these vulnerabilities. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for pidgin →
FAQ
Pidgin is a multi-protocol instant messaging client that allows users to connect to multiple chat networks simultaneously.
These vulnerabilities can be exploited by remote attackers to crash Pidgin or execute arbitrary code, potentially compromising the security and stability of the system.
To fix these vulnerabilities, it is recommended to upgrade Pidgin to version 2.10.9-1 or later.
There are no specific workarounds mentioned for these vulnerabilities. It is crucial to apply the recommended fix by upgrading Pidgin to the latest version.
The latest version of Pidgin can be downloaded from the official Pidgin website.
Related vulnerabilities
Recent vulnerabilities recorded for pidgin.
