Security update for pidgin SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2016:2416-1 Final 1 1 2016-09-29T13:16:31Z current 2016-09-29T13:16:31Z 2016-09-29T13:16:31Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for pidgin This update for pidgin fixes the following issues: Security issues fixed: - CVE-2016-2367: Fixed a MXIT Avatar Length Memory Disclosure Vulnerability (bsc#991715). - CVE-2016-2370: Fixed a MXIT Custom Resource Denial of Service Vulnerability (bsc#991712). - CVE-2016-2371: Fixed a MXIT Extended Profiles Code Execution Vulnerability (bsc#991691). - CVE-2016-2372: Fixed a MXIT File Transfer Length Memory Disclosure Vulnerability (bsc#991711). - CVE-2016-2373: Fixed a MXIT Contact Mood Denial of Service Vulnerability (bsc#991709) The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). sdksp4-pidgin-12767 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2016/suse-su-20162416-1/ Link for SUSE-SU-2016:2416-1 https://lists.opensuse.org/opensuse-security-announce/2016-09/msg00035.html E-Mail link for SUSE-SU-2016:2416-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/991691 SUSE Bug 991691 https://bugzilla.suse.com/991709 SUSE Bug 991709 https://bugzilla.suse.com/991711 SUSE Bug 991711 https://bugzilla.suse.com/991712 SUSE Bug 991712 https://bugzilla.suse.com/991715 SUSE Bug 991715 https://www.suse.com/security/cve/CVE-2016-2367/ SUSE CVE CVE-2016-2367 page https://www.suse.com/security/cve/CVE-2016-2370/ SUSE CVE CVE-2016-2370 page https://www.suse.com/security/cve/CVE-2016-2371/ SUSE CVE CVE-2016-2371 page https://www.suse.com/security/cve/CVE-2016-2372/ SUSE CVE CVE-2016-2372 page https://www.suse.com/security/cve/CVE-2016-2373/ SUSE CVE CVE-2016-2373 page SUSE Linux Enterprise Software Development Kit 11 SP4 finch-2.6.6-0.29.1 finch-devel-2.6.6-0.29.1 libpurple-2.6.6-0.29.1 libpurple-devel-2.6.6-0.29.1 libpurple-lang-2.6.6-0.29.1 pidgin-2.6.6-0.29.1 pidgin-devel-2.6.6-0.29.1 finch-2.6.6-0.29.1 as a component of SUSE Linux Enterprise Software Development Kit 11 SP4 finch-devel-2.6.6-0.29.1 as a component of SUSE Linux Enterprise Software Development Kit 11 SP4 libpurple-2.6.6-0.29.1 as a component of SUSE Linux Enterprise Software Development Kit 11 SP4 libpurple-devel-2.6.6-0.29.1 as a component of SUSE Linux Enterprise Software Development Kit 11 SP4 libpurple-lang-2.6.6-0.29.1 as a component of SUSE Linux Enterprise Software Development Kit 11 SP4 pidgin-2.6.6-0.29.1 as a component of SUSE Linux Enterprise Software Development Kit 11 SP4 pidgin-devel-2.6.6-0.29.1 as a component of SUSE Linux Enterprise Software Development Kit 11 SP4 An information leak exists in the handling of the MXIT protocol in Pidgin. Specially crafted MXIT data sent via the server could potentially result in an out-of-bounds read. A malicious user, server, or man-in-the-middle can send an invalid size for an avatar which will trigger an out-of-bounds read vulnerability. This could result in a denial of service or copy data from memory to the file, resulting in an information leak if the avatar is sent to another user. CVE-2016-2367 SUSE Linux Enterprise Software Development Kit 11 SP4:finch-2.6.6-0.29.1 SUSE Linux Enterprise Software Development Kit 11 SP4:finch-devel-2.6.6-0.29.1 SUSE Linux Enterprise Software Development Kit 11 SP4:libpurple-2.6.6-0.29.1 SUSE Linux Enterprise Software Development Kit 11 SP4:libpurple-devel-2.6.6-0.29.1 SUSE Linux Enterprise Software Development Kit 11 SP4:libpurple-lang-2.6.6-0.29.1 SUSE Linux Enterprise Software Development Kit 11 SP4:pidgin-2.6.6-0.29.1 SUSE Linux Enterprise Software Development Kit 11 SP4:pidgin-devel-2.6.6-0.29.1 important 5.8 AV:N/AC:M/Au:N/C:P/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2016/suse-su-20162416-1/ https://www.suse.com/security/cve/CVE-2016-2367.html CVE-2016-2367 https://bugzilla.suse.com/984655 SUSE Bug 984655 https://bugzilla.suse.com/991712 SUSE Bug 991712 https://bugzilla.suse.com/991715 SUSE Bug 991715 A denial of service vulnerability exists in the handling of the MXIT protocol in Pidgin. Specially crafted MXIT data sent from the server could potentially result in an out-of-bounds read. A malicious server or man-in-the-middle attacker can send invalid data to trigger this vulnerability. CVE-2016-2370 SUSE Linux Enterprise Software Development Kit 11 SP4:finch-2.6.6-0.29.1 SUSE Linux Enterprise Software Development Kit 11 SP4:finch-devel-2.6.6-0.29.1 SUSE Linux Enterprise Software Development Kit 11 SP4:libpurple-2.6.6-0.29.1 SUSE Linux Enterprise Software Development Kit 11 SP4:libpurple-devel-2.6.6-0.29.1 SUSE Linux Enterprise Software Development Kit 11 SP4:libpurple-lang-2.6.6-0.29.1 SUSE Linux Enterprise Software Development Kit 11 SP4:pidgin-2.6.6-0.29.1 SUSE Linux Enterprise Software Development Kit 11 SP4:pidgin-devel-2.6.6-0.29.1 important 4.3 AV:N/AC:M/Au:N/C:N/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2016/suse-su-20162416-1/ https://www.suse.com/security/cve/CVE-2016-2370.html CVE-2016-2370 https://bugzilla.suse.com/984655 SUSE Bug 984655 https://bugzilla.suse.com/991712 SUSE Bug 991712 An out-of-bounds write vulnerability exists in the handling of the MXIT protocol in Pidgin. Specially crafted MXIT data sent via the server could cause memory corruption resulting in code execution. CVE-2016-2371 SUSE Linux Enterprise Software Development Kit 11 SP4:finch-2.6.6-0.29.1 SUSE Linux Enterprise Software Development Kit 11 SP4:finch-devel-2.6.6-0.29.1 SUSE Linux Enterprise Software Development Kit 11 SP4:libpurple-2.6.6-0.29.1 SUSE Linux Enterprise Software Development Kit 11 SP4:libpurple-devel-2.6.6-0.29.1 SUSE Linux Enterprise Software Development Kit 11 SP4:libpurple-lang-2.6.6-0.29.1 SUSE Linux Enterprise Software Development Kit 11 SP4:pidgin-2.6.6-0.29.1 SUSE Linux Enterprise Software Development Kit 11 SP4:pidgin-devel-2.6.6-0.29.1 important 6.8 AV:N/AC:M/Au:N/C:P/I:P/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2016/suse-su-20162416-1/ https://www.suse.com/security/cve/CVE-2016-2371.html CVE-2016-2371 https://bugzilla.suse.com/984655 SUSE Bug 984655 https://bugzilla.suse.com/991691 SUSE Bug 991691 An information leak exists in the handling of the MXIT protocol in Pidgin. Specially crafted MXIT data sent via the server could potentially result in an out-of-bounds read. A malicious user, server, or man-in-the-middle attacker can send an invalid size for a file transfer which will trigger an out-of-bounds read vulnerability. This could result in a denial of service or copy data from memory to the file, resulting in an information leak if the file is sent to another user. CVE-2016-2372 SUSE Linux Enterprise Software Development Kit 11 SP4:finch-2.6.6-0.29.1 SUSE Linux Enterprise Software Development Kit 11 SP4:finch-devel-2.6.6-0.29.1 SUSE Linux Enterprise Software Development Kit 11 SP4:libpurple-2.6.6-0.29.1 SUSE Linux Enterprise Software Development Kit 11 SP4:libpurple-devel-2.6.6-0.29.1 SUSE Linux Enterprise Software Development Kit 11 SP4:libpurple-lang-2.6.6-0.29.1 SUSE Linux Enterprise Software Development Kit 11 SP4:pidgin-2.6.6-0.29.1 SUSE Linux Enterprise Software Development Kit 11 SP4:pidgin-devel-2.6.6-0.29.1 important 5.8 AV:N/AC:M/Au:N/C:P/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2016/suse-su-20162416-1/ https://www.suse.com/security/cve/CVE-2016-2372.html CVE-2016-2372 https://bugzilla.suse.com/984655 SUSE Bug 984655 https://bugzilla.suse.com/991711 SUSE Bug 991711 A denial of service vulnerability exists in the handling of the MXIT protocol in Pidgin. Specially crafted MXIT data sent via the server could potentially result in an out-of-bounds read. A malicious server or user can send an invalid mood to trigger this vulnerability. CVE-2016-2373 SUSE Linux Enterprise Software Development Kit 11 SP4:finch-2.6.6-0.29.1 SUSE Linux Enterprise Software Development Kit 11 SP4:finch-devel-2.6.6-0.29.1 SUSE Linux Enterprise Software Development Kit 11 SP4:libpurple-2.6.6-0.29.1 SUSE Linux Enterprise Software Development Kit 11 SP4:libpurple-devel-2.6.6-0.29.1 SUSE Linux Enterprise Software Development Kit 11 SP4:libpurple-lang-2.6.6-0.29.1 SUSE Linux Enterprise Software Development Kit 11 SP4:pidgin-2.6.6-0.29.1 SUSE Linux Enterprise Software Development Kit 11 SP4:pidgin-devel-2.6.6-0.29.1 important 4.3 AV:N/AC:M/Au:N/C:N/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2016/suse-su-20162416-1/ https://www.suse.com/security/cve/CVE-2016-2373.html CVE-2016-2373 https://bugzilla.suse.com/984655 SUSE Bug 984655 https://bugzilla.suse.com/991709 SUSE Bug 991709