Advisories » MGASA-2017-0102

Updated pidgin packages fix security vulnerability

Publication date: 04 Apr 2017
Modification date: 04 Apr 2017
Type: security
Affected Mageia releases : 5
CVE: CVE-2017-2640

Description

A server controlled by an attacker can send an invalid XML that can
trigger an out-of-bound memory access. This might lead to a crash or, in
some extreme cases, to remote code execution in the client-side
(CVE-2017-2640).

The pidgin package has been updated to version 2.12.0, which fixes this
issue and other bugs, including certificate validation for the Google Talk
protocol. It also removes protocol plugins for services that are no longer
available or supported.  See the upstream ChangeLog for details.
                

References

• https://bugs.mageia.org/show_bug.cgi?id=20442
• http://pidgin.im/news/security/?id=109
• https://bitbucket.org/pidgin/www/src/tip/htdocs/ChangeLog?fileviewer=file-view-default
• https://www.debian.org/security/2017/dsa-3806
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-2640

SRPMS

5/core

• pidgin-2.12.0-1.mga5