Test ID:	1.3.6.1.4.1.25623.1.0.702859
Category:	Debian Local Security Checks
Title:	Debian: Security Advisory (DSA-2859-2)
Summary:	The remote host is missing an update for the Debian 'pidgin' package(s) announced via the DSA-2859-2 advisory.
Description:	Summary: The remote host is missing an update for the Debian 'pidgin' package(s) announced via the DSA-2859-2 advisory. Vulnerability Insight: Multiple vulnerabilities have been discovered in Pidgin, a multi-protocol instant messaging client: CVE-2013-6477 Jaime Breva Ribes discovered that a remote XMPP user can trigger a crash by sending a message with a timestamp in the distant future. CVE-2013-6478 Pidgin could be crashed through overly wide tooltip windows. CVE-2013-6479 Jacob Appelbaum discovered that a malicious server or a man in the middle could send a malformed HTTP header resulting in denial of service. CVE-2013-6481 Daniel Atallah discovered that Pidgin could be crashed through malformed Yahoo! P2P messages. CVE-2013-6482 Fabian Yamaguchi and Christian Wressnegger discovered that Pidgin could be crashed through malformed MSN messages. CVE-2013-6483 Fabian Yamaguchi and Christian Wressnegger discovered that Pidgin could be crashed through malformed XMPP messages. CVE-2013-6484 It was discovered that incorrect error handling when reading the response from a STUN server could result in a crash. CVE-2013-6485 Matt Jones discovered a buffer overflow in the parsing of malformed HTTP responses. CVE-2013-6487 Yves Younan and Ryan Pentney discovered a buffer overflow when parsing Gadu-Gadu messages. CVE-2013-6489 Yves Younan and Pawel Janic discovered an integer overflow when parsing MXit emoticons. CVE-2013-6490 Yves Younan discovered a buffer overflow when parsing SIMPLE headers. CVE-2014-0020 Daniel Atallah discovered that Pidgin could be crashed via malformed IRC arguments. For the oldstable distribution (squeeze), no direct backport is provided. A fixed package will be provided through backports.debian.org shortly. For the stable distribution (wheezy), these problems have been fixed in version 2.10.9-1~ deb7u1. For the unstable distribution (sid), these problems have been fixed in version 2.10.9-1. We recommend that you upgrade your pidgin packages. Affected Software/OS: 'pidgin' package(s) on Debian 6. Solution: Please install the updated package(s). CVSS Score: 10.0 CVSS Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C
Cross-Ref:	Common Vulnerability Exposure (CVE) ID: CVE-2013-6477 Debian Security Information: DSA-2859 (Google Search) http://www.debian.org/security/2014/dsa-2859 RedHat Security Advisories: RHSA-2014:0139 https://rhn.redhat.com/errata/RHSA-2014-0139.html SuSE Security Announcement: openSUSE-SU-2014:0239 (Google Search) http://lists.opensuse.org/opensuse-updates/2014-02/msg00039.html SuSE Security Announcement: openSUSE-SU-2014:0326 (Google Search) http://lists.opensuse.org/opensuse-updates/2014-03/msg00005.html http://www.ubuntu.com/usn/USN-2100-1 Common Vulnerability Exposure (CVE) ID: CVE-2013-6478 http://pidgin.im/pipermail/support/2013-March/012980.html http://pidgin.im/pipermail/support/2013-March/012981.html Common Vulnerability Exposure (CVE) ID: CVE-2013-6479 Common Vulnerability Exposure (CVE) ID: CVE-2013-6481 Common Vulnerability Exposure (CVE) ID: CVE-2013-6482 Common Vulnerability Exposure (CVE) ID: CVE-2013-6483 Common Vulnerability Exposure (CVE) ID: CVE-2013-6484 Common Vulnerability Exposure (CVE) ID: CVE-2013-6485 BugTraq ID: 65243 http://www.securityfocus.com/bid/65243 Common Vulnerability Exposure (CVE) ID: CVE-2013-6487 BugTraq ID: 65188 http://www.securityfocus.com/bid/65188 Debian Security Information: DSA-2852 (Google Search) http://www.debian.org/security/2014/dsa-2852 http://lists.fedoraproject.org/pipermail/package-announce/2014-February/128277.html https://security.gentoo.org/glsa/201508-02 http://www.mandriva.com/security/advisories?name=MDVSA-2014:039 http://libgadu.net/releases/1.11.3.html http://vrt-blog.snort.org/2014/01/vrt-2013-1001-cve-2013-6487-buffer.html http://www.ubuntu.com/usn/USN-2101-1 Common Vulnerability Exposure (CVE) ID: CVE-2013-6489 BugTraq ID: 65192 http://www.securityfocus.com/bid/65192 http://hg.pidgin.im/pidgin/main/rev/4c897372b5a4 Common Vulnerability Exposure (CVE) ID: CVE-2013-6490 BugTraq ID: 65195 http://www.securityfocus.com/bid/65195 Common Vulnerability Exposure (CVE) ID: CVE-2014-0020
Copyright	Copyright (C) 2014 Greenbone AG

This is only one of 145615 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.