| Description: | Description:
The remote host is missing an update to pidgin
announced via advisory MDVSA-2011:132-1.
Multiple vulnerabilities has been identified and fixed in pidgin:
It was found that the gdk-pixbuf GIF image loader routine
gdk_pixbuf__gif_image_load() did not properly handle certain return
values from its subroutines. A remote attacker could provide a
specially-crafted GIF image, which, once opened in Pidgin, would lead
gdk-pixbuf to return a partially initialized pixbuf structure. Using
this structure, possibly containing a huge width and height, could
lead to the application being terminated due to excessive memory use
(CVE-2011-2485).
Certain characters in the nicknames of IRC users can trigger a
null pointer dereference in the IRC protocol plugin'
s handling of
responses to WHO requests. This can cause a crash on some operating
systems. Clients based on libpurple 2.8.0 through 2.9.0 are affected
(CVE-2011-2943).
Incorrect handling of HTTP 100 responses in the MSN protocol plugin
can cause the application to attempt to access memory that it does
not have access to. This only affects users who have turned on the
HTTP connection method for their accounts (it'
s off by default). This
might only be triggerable by a malicious server and not a malicious
peer. We believe remote code execution is not possible (CVE-2011-3184).
This update provides pidgin 2.10.0, which is not vulnerable to
these issues.
Update:
Packages for Mandriva Linux 2011 is now being provided as well. Enjoy!
Affected: 2011.
Solution:
To upgrade automatically use MandrakeUpdate or urpmi. The verification
of md5 checksums and GPG signatures is performed automatically for you.
http://www.securityspace.com/smysecure/catid.html?in=MDVSA-2011:132-1
http://pidgin.im/news/security/
Risk factor : High
|
