Test ID:	1.3.6.1.4.1.25623.1.0.69248
Category:	Mandrake Local Security Checks
Title:	Mandriva Security Advisory MDVSA-2011:050 (pidgin)
Summary:	NOSUMMARY
Description:	Description: The remote host is missing an update to pidgin announced via advisory MDVSA-2011:050. Multiple vulnerabilities has been identified and fixed in pidgin: It was discovered that libpurple versions prior to 2.7.10 do not properly clear certain data structures used in libpurple/cipher.c prior to freeing. An attacker could potentially extract partial information from memory regions freed by libpurple. The Yahoo protocol plugin in libpurple versions 2.6.0 through 2.7.10 do not properly handle malformed YMSG packets, leading to NULL pointer dereferences and application crash (CVE-2011-1091). Packages for 2009.0 are provided as of the Extended Maintenance Program. Please visit this link to learn more: http://store.mandriva.com/product_info.php?cPath=149&products_id=490 This update provides pidgin 2.7.11, which is not vulnerable to these issues. Affected: 2009.0, 2010.0, 2010.1, Enterprise Server 5.0 Solution: To upgrade automatically use MandrakeUpdate or urpmi. The verification of md5 checksums and GPG signatures is performed automatically for you. http://www.securityspace.com/smysecure/catid.html?in=MDVSA-2011:050 http://pidgin.im/news/security/ http://www.pidgin.im/news/security/?id=50 Risk factor : Medium CVSS Score: 4.0
Cross-Ref:	Common Vulnerability Exposure (CVE) ID: CVE-2011-1091 43695 http://secunia.com/advisories/43695 43721 http://secunia.com/advisories/43721 46376 http://secunia.com/advisories/46376 46837 http://www.securityfocus.com/bid/46837 ADV-2011-0643 http://www.vupen.com/english/advisories/2011/0643 ADV-2011-0661 http://www.vupen.com/english/advisories/2011/0661 ADV-2011-0669 http://www.vupen.com/english/advisories/2011/0669 ADV-2011-0703 http://www.vupen.com/english/advisories/2011/0703 FEDORA-2011-3113 http://lists.fedoraproject.org/pipermail/package-announce/2011-March/055874.html FEDORA-2011-3150 http://lists.fedoraproject.org/pipermail/package-announce/2011-March/056309.html RHSA-2011:0616 http://www.redhat.com/support/errata/RHSA-2011-0616.html RHSA-2011:1371 http://www.redhat.com/support/errata/RHSA-2011-1371.html SSA:2011-070-02 http://slackware.com/security/viewer.php?l=slackware-security&y=2011&m=slackware-security.466884 http://developer.pidgin.im/viewmtn/revision/diff/5cbe18129b6e7c660bc093f7e5e1414ceca17d04/with/a7c415abba1f5f01f79295337518837f73d99bb7/libpurple/protocols/yahoo/libymsg.c http://developer.pidgin.im/viewmtn/revision/info/a7c415abba1f5f01f79295337518837f73d99bb7 http://www.pidgin.im/news/security/?id=51 https://bugzilla.redhat.com/show_bug.cgi?id=683031 openSUSE-SU-2012:0066 https://hermes.opensuse.org/messages/13195955 oval:org.mitre.oval:def:18402 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A18402 pidgin-yahoo-protocol-dos(66055) https://exchange.xforce.ibmcloud.com/vulnerabilities/66055
Copyright	Copyright (c) 2011 E-Soft Inc. http://www.securityspace.com

This is only one of 145615 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.