Pidgin: New Packages Fix Regression Vulnerability

Users of pidgin please be advised of a New packages fix regression vulnerability that has been identified.
To view this vulnerability, possible remedies, and others please check out the Security Advisories at Critical Watch (http://criticalwatch.com/support/security-advisories.aspx)

DSA 2038-3: [DSA 2038-3] New pidgin packages fix regression
Several remote vulnerabilities have been discovered in Pidgin, a multi

protocol instant messaging client. The Common Vulnerabilities and

Exposures project identifies the following problems:

CVE-2010-0420

Crafted nicknames in the XMPP protocol can crash Pidgin remotely.

CVE-2010-0423

Remote contacts may send too many custom smilies, crashing Pidgin.

Since a few months, Microsoft’s servers for MSN have changed the protocol,

making Pidgin non-functional for use with MSN. It is not feasible to port

these changes to the version of Pidgin in Debian Lenny. This update

formalises that situation by disabling the protocol in the client. Users

of the MSN protocol are advised to use the version of Pidgin in the

repositories of http://www.backports.org.
Read more at http://www.criticalwatch.com

 

Advertisements