Medium ELSA-2017-1854 5 CVEs

Moderate: pidgin security, bug fix, and enhancement update (Oracle Linux 7)

Published Aug 7, 2017 · Updated Aug 7, 2017

Ecosystem: Oracle Linux

Summary

[2.10.11-5]
- Drop MXit support in RHEL
Resolves: #1439296

[2.10.11-4]
- Silence -Wsign-compare
- Rename the previous patch for consistency
Resolves: #1445921, #1446368

[2.10.11-3]
- Avoid a use-after-free in an error path
Resolves: #1445921

[2.10.11-2]
- Add patch for CVE-2017-2640
Resolves: #1431022

[2.10.11-1]
- Update to 2.10.11
Resolves: #1369526

Fixed packages 9

Release	Package	Fixed in
Oracle Linux · 7	finch	0:2.10.11-5.el7
Oracle Linux · 7	finch-devel	0:2.10.11-5.el7
Oracle Linux · 7	libpurple	0:2.10.11-5.el7
Oracle Linux · 7	libpurple-devel	0:2.10.11-5.el7
Oracle Linux · 7	libpurple-perl	0:2.10.11-5.el7
Oracle Linux · 7	libpurple-tcl	0:2.10.11-5.el7
Oracle Linux · 7	pidgin	0:2.10.11-5.el7
Oracle Linux · 7	pidgin-devel	0:2.10.11-5.el7
Oracle Linux · 7	pidgin-perl	0:2.10.11-5.el7

Vulnerabilities 5

High 7.5

CVE-2017-2640

An out-of-bounds write flaw was found in the way Pidgin before 2.12.0 processed XML content. A malicious remote server …

Pidgin Pidgin pidgin pidgin Debian Ubuntu Alpine

Jul 27, 2018
Unscored —

CVE-2014-3694

The (1) bundled GnuTLS SSL/TLS plugin and the (2) bundled OpenSSL SSL/TLS plugin in libpurple in Pidgin before 2.10.10 …

pidgin pidgin Debian Ubuntu

Oct 29, 2014
Unscored —

CVE-2014-3695

markup.c in the MXit protocol plugin in libpurple in Pidgin before 2.10.10 allows remote servers to cause a denial of s…

pidgin pidgin Debian Ubuntu

Oct 29, 2014
Unscored —

CVE-2014-3696

nmevent.c in the Novell GroupWise protocol plugin in libpurple in Pidgin before 2.10.10 allows remote servers to cause …

pidgin pidgin Debian Ubuntu

Oct 29, 2014
Unscored —

CVE-2014-3698

The jabber_idn_validate function in jutil.c in the Jabber protocol plugin in libpurple in Pidgin before 2.10.10 allows …

pidgin pidgin Debian Ubuntu

Oct 29, 2014