Information disclosure in Pidgin - CVE-2011-4922

Vulnerability identifier: #VU43757

CSH Severity: Low

CVSS v4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2011-4922

CWE-ID: CWE-200

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote non-authenticated attacker to gain access to sensitive information.

cipher.c in the Cipher API in libpurple in Pidgin before 2.7.10 retains encryption-key data in process memory, which might allow local users to obtain sensitive information by reading a core file or other representation of memory contents.

Pidgin
Ubuntu
libpurple0 (Ubuntu package)
finch (Ubuntu package)
pidgin (Ubuntu package)

Install update from vendor's website.

libpurple0 (Ubuntu package) - addressed in versions 1:2.6.6-1ubuntu4.5, 1:2.7.11-1ubuntu2.2, 1:2.10.0-0ubuntu2.1, 1:2.10.3-0ubuntu1.1
finch (Ubuntu package) - addressed in versions 1:2.6.6-1ubuntu4.5, 1:2.7.11-1ubuntu2.2, 1:2.10.0-0ubuntu2.1, 1:2.10.3-0ubuntu1.1
pidgin (Ubuntu package) - addressed in versions 1:2.6.6-1ubuntu4.5, 1:2.7.11-1ubuntu2.2, 1:2.10.0-0ubuntu2.1, 1:2.10.3-0ubuntu1.1

• http://hg.pidgin.im/pidgin/main/rev/8c850977cb42
• http://openwall.com/lists/oss-security/2012/01/04/13
• http://www.pidgin.im/news/security/?id=50
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A18223

• Information disclosure in pidgin.im Pidgin
• Ubuntu update for pidgin