SB2014020311 - Slackware Linux update for pidgin
Published: February 3, 2014 Updated: January 1, 2023
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 14 vulnerabilities.
1) Input validation error (CVE-ID: CVE-2012-6152)
The vulnerability allows a remote non-authenticated attacker to perform service disruption.
The Yahoo! protocol plugin in libpurple in Pidgin before 2.10.8 does not properly validate UTF-8 data, which allows remote attackers to cause a denial of service (application crash) via crafted byte sequences.
2) Input validation error (CVE-ID: CVE-2013-6477)
The vulnerability allows a remote non-authenticated attacker to perform service disruption.
Multiple integer signedness errors in libpurple in Pidgin before 2.10.8 allow remote attackers to cause a denial of service (application crash) via a crafted timestamp value in an XMPP message.
3) Input validation error (CVE-ID: CVE-2013-6478)
The vulnerability allows a remote non-authenticated attacker to perform service disruption.
gtkimhtml.c in Pidgin before 2.10.8 does not properly interact with underlying library support for wide Pango layouts, which allows user-assisted remote attackers to cause a denial of service (application crash) via a long URL that is examined with a tooltip.
4) Resource management error (CVE-ID: CVE-2013-6479)
The vulnerability allows a remote non-authenticated attacker to perform service disruption.
util.c in libpurple in Pidgin before 2.10.8 does not properly allocate memory for HTTP responses that are inconsistent with the Content-Length header, which allows remote HTTP servers to cause a denial of service (application crash) via a crafted response.
5) Out-of-bounds read (CVE-ID: CVE-2013-6481)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to a boundary error in libpurple/protocols/yahoo/libymsg.c in Pidgin before 2.10.8. A remote attacker can perform a denial of service (crash) via a Yahoo! P2P message with a crafted length field, which triggers a buffer over-read.
6) NULL pointer dereference (CVE-ID: CVE-2013-6482)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to a NULL pointer dereference error. A remote attacker can trigger denial of service conditions via a crafted (1) SOAP response, (2) OIM XML response, or (3) Content-Length header.
7) NULL pointer dereference (CVE-ID: CVE-2013-6483)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to a NULL pointer dereference error. A remote attacker can trigger denial of service conditions via a crafted reply.
8) Input validation error (CVE-ID: CVE-2013-6484)
The vulnerability allows a remote non-authenticated attacker to perform service disruption.
The STUN protocol implementation in libpurple in Pidgin before 2.10.8 allows remote STUN servers to cause a denial of service (out-of-bounds write operation and application crash) by triggering a socket read error.
9) Buffer overflow (CVE-ID: CVE-2013-6485)
The vulnerability allows a remote non-authenticated attacker to perform service disruption.
Buffer overflow in util.c in libpurple in Pidgin before 2.10.8 allows remote HTTP servers to cause a denial of service (application crash) or possibly have unspecified other impact via an invalid chunk-size field in chunked transfer-coding data.
10) Input validation error (CVE-ID: CVE-2013-6486)
The vulnerability allows a remote non-authenticated attacker to execute arbitrary code.
gtkutils.c in Pidgin before 2.10.8 on Windows allows user-assisted remote attackers to execute arbitrary programs via a message containing a file: URL that is improperly handled during construction of an explorer.exe command. NOTE: this vulnerability exists because of an incomplete fix for CVE-2011-3185.
11) Input validation error (CVE-ID: CVE-2013-6487)
The vulnerability allows a remote non-authenticated attacker to read and manipulate data.
Integer overflow in libpurple/protocols/gg/lib/http.c in the Gadu-Gadu (gg) parser in Pidgin before 2.10.8 allows remote attackers to have an unspecified impact via a large Content-Length value, which triggers a buffer overflow.
12) Input validation error (CVE-ID: CVE-2013-6489)
The vulnerability allows a remote non-authenticated attacker to perform service disruption.
Integer signedness error in the MXit functionality in Pidgin before 2.10.8 allows remote attackers to cause a denial of service (segmentation fault) via a crafted emoticon value, which triggers an integer overflow and a buffer overflow.
13) Buffer overflow (CVE-ID: CVE-2013-6490)
The vulnerability allows a remote non-authenticated attacker to execute arbitrary code.
The SIMPLE protocol functionality in Pidgin before 2.10.8 allows remote attackers to have an unspecified impact via a negative Content-Length header, which triggers a buffer overflow.
14) Input validation error (CVE-ID: CVE-2014-0020)
The vulnerability allows a remote non-authenticated attacker to perform service disruption.
The IRC protocol plugin in libpurple in Pidgin before 2.10.8 does not validate argument counts, which allows remote IRC servers to cause a denial of service (application crash) via a crafted message.
Remediation
Install update from vendor's website.