Executive Summary
This Alert is flagged as TOP 25 Common Weakness Enumeration from CWE/SANS. For more information, you can read this.
| Summary | |
|---|---|
| Title | pidgin security update |
| Informations | |||
|---|---|---|---|
| Name | DSA-2859 | First vendor Publication | 2014-02-10 |
| Vendor | Debian | Last vendor Modification | 2014-03-19 |
| Severity (Vendor) | N/A | Revision | 2 |
Security-Database Scoring CVSS v3
| Cvss vector : N/A | |||
|---|---|---|---|
| Overall CVSS Score | NA | ||
| Base Score | NA | Environmental Score | NA |
| impact SubScore | NA | Temporal Score | NA |
| Exploitabality Sub Score | NA | ||
| Calculate full CVSS 3.0 Vectors scores | |||
Security-Database Scoring CVSS v2
| Cvss vector : (AV:N/AC:L/Au:N/C:C/I:C/A:C) | |||
|---|---|---|---|
| Cvss Base Score | 10 | Attack Range | Network |
| Cvss Impact Score | 10 | Attack Complexity | Low |
| Cvss Expoit Score | 10 | Authentication | None Required |
| Calculate full CVSS 2.0 Vectors scores | |||
Detail
| Multiple vulnerabilities have been discovered in pidgin, a multi-protocol instant messaging client. In addition to fixing the vulnerabilities, this revision specific to the oldstable distribution (squeeze), reduces the supported protocols to: IRC, Jabber/XMPP, Sametime, and SIMPLE. Users of other protocols are encouraged to either upgrade to the stable distribution (wheezy) or to use the version in backports. It must be noted, however, that the latter is not supported by the Security Team. For reference, the original description of the vulnerabilities from DSA-2859-1 is quoted below: CVE-2013-6485 Matt Jones discovered a buffer overflow in the parsing of malformed HTTP responses. CVE-2013-6490 Yves Younan discovered a buffer overflow when parsing SIMPLE headers. For the oldstable distribution (squeeze), these problems have been fixed in version 2.7.3-1+squeeze4. We recommend that you upgrade your pidgin packages. |
Original Source
| Url : http://www.debian.org/security/2014/dsa-2859 |
CWE : Common Weakness Enumeration
| % | Id | Name |
|---|---|---|
| 42 % | CWE-20 | Improper Input Validation |
| 25 % | CWE-189 | Numeric Errors (CWE/SANS Top 25) |
| 25 % | CWE-119 | Failure to Constrain Operations within the Bounds of a Memory Buffer |
| 8 % | CWE-399 | Resource Management Errors |
OVAL Definitions
| Definition Id: oval:org.mitre.oval:def:22226 | |||
| Oval ID: | oval:org.mitre.oval:def:22226 | ||
| Title: | DSA-2852-1 libgadu - heap-based buffer overflow | ||
| Description: | Yves Younan and Ryan Pentney discovered that libgadu, a library for accessing the Gadu-Gadu instant messaging service, contained an integer overflow leading to a buffer overflow. Attackers which impersonate the server could crash clients and potentially execute arbitrary code. | ||
| Family: | unix | Class: | patch |
| Reference(s): | DSA-2852-1 CVE-2013-6487 | Version: | 5 |
| Platform(s): | Debian GNU/Linux 7 Debian GNU/Linux 6.0 Debian GNU/kFreeBSD 7 Debian GNU/kFreeBSD 6.0 | Product(s): | libgadu |
| Definition Synopsis: | |||
| |||
| Definition Id: oval:org.mitre.oval:def:22257 | |||
| Oval ID: | oval:org.mitre.oval:def:22257 | ||
| Title: | USN-2101-1 -- libgadu vulnerability | ||
| Description: | libgadu could be made to crash or run programs if it received specially crafted network traffic. | ||
| Family: | unix | Class: | patch |
| Reference(s): | USN-2101-1 CVE-2013-6487 | Version: | 5 |
| Platform(s): | Ubuntu 13.10 Ubuntu 12.10 Ubuntu 12.04 | Product(s): | libgadu |
| Definition Synopsis: | |||
| |||
| Definition Id: oval:org.mitre.oval:def:22474 | |||
| Oval ID: | oval:org.mitre.oval:def:22474 | ||
| Title: | DSA-2859-1 pidgin - several | ||
| Description: | Multiple vulnerabilities have been discovered in Pidgin, a multi-protocol instant messaging client. | ||
| Family: | unix | Class: | patch |
| Reference(s): | DSA-2859-1 CVE-2013-6477 CVE-2013-6478 CVE-2013-6479 CVE-2013-6481 CVE-2013-6482 CVE-2013-6483 CVE-2013-6484 CVE-2013-6485 CVE-2013-6487 CVE-2013-6489 CVE-2013-6490 CVE-2014-0020 | Version: | 5 |
| Platform(s): | Debian GNU/Linux 7 Debian GNU/kFreeBSD 7 | Product(s): | pidgin |
| Definition Synopsis: | |||
| |||
| Definition Id: oval:org.mitre.oval:def:22557 | |||
| Oval ID: | oval:org.mitre.oval:def:22557 | ||
| Title: | USN-2100-1 -- pidgin vulnerabilities | ||
| Description: | Several security issues were fixed in Pidgin. | ||
| Family: | unix | Class: | patch |
| Reference(s): | USN-2100-1 CVE-2012-6152 CVE-2013-6477 CVE-2013-6478 CVE-2013-6479 CVE-2013-6481 CVE-2013-6482 CVE-2013-6483 CVE-2013-6484 CVE-2013-6485 CVE-2013-6487 CVE-2013-6489 CVE-2013-6490 CVE-2014-0020 | Version: | 5 |
| Platform(s): | Ubuntu 13.10 Ubuntu 12.10 Ubuntu 12.04 | Product(s): | pidgin |
| Definition Synopsis: | |||
| |||
| Definition Id: oval:org.mitre.oval:def:24323 | |||
| Oval ID: | oval:org.mitre.oval:def:24323 | ||
| Title: | DSA-2859-2 pidgin - security update | ||
| Description: | Multiple vulnerabilities have been discovered in Pidgin, a multi-protocol instant messaging client. | ||
| Family: | unix | Class: | patch |
| Reference(s): | DSA-2859-2 CVE-2013-6477 CVE-2013-6478 CVE-2013-6479 CVE-2013-6481 CVE-2013-6482 CVE-2013-6483 CVE-2013-6484 CVE-2013-6485 CVE-2013-6487 CVE-2013-6489 CVE-2013-6490 CVE-2014-0020 | Version: | 5 |
| Platform(s): | Debian GNU/Linux 6.0 Debian GNU/kFreeBSD 6.0 | Product(s): | pidgin |
| Definition Synopsis: | |||
| |||
| Definition Id: oval:org.mitre.oval:def:25421 | |||
| Oval ID: | oval:org.mitre.oval:def:25421 | ||
| Title: | SUSE-SU-2014:0790-1 -- Security update for libgadu | ||
| Description: | A memory corruption vulnerability has been fixed in libgadu. CVE-2013-6487 has been assigned to this issue. | ||
| Family: | unix | Class: | patch |
| Reference(s): | SUSE-SU-2014:0790-1 CVE-2013-6487 | Version: | 3 |
| Platform(s): | SUSE Linux Enterprise Desktop 11 | Product(s): | libgadu |
| Definition Synopsis: | |||
CPE : Common Platform Enumeration
Snort® IPS/IDS
| Date | Description |
|---|---|
| 2014-01-10 | Pidgin MXIT emoticon integer overflow attempt RuleID : 28088 - Revision : 4 - Type : POLICY-SOCIAL |
Nessus® Vulnerability Scanner
| Date | Description |
|---|---|
| 2015-08-17 | Name : The remote Gentoo host is missing one or more security-related patches. File : gentoo_GLSA-201508-02.nasl - Type : ACT_GATHER_INFO |
| 2015-01-19 | Name : The remote Solaris system is missing a security patch for third-party software. File : solaris11_pidgin_20140731.nasl - Type : ACT_GATHER_INFO |
| 2014-06-13 | Name : The remote SuSE 11 host is missing a security update. File : suse_11_libgadu-140521.nasl - Type : ACT_GATHER_INFO |
| 2014-06-13 | Name : The remote openSUSE host is missing a security update. File : openSUSE-2014-400.nasl - Type : ACT_GATHER_INFO |
| 2014-06-13 | Name : The remote openSUSE host is missing a security update. File : openSUSE-2014-132.nasl - Type : ACT_GATHER_INFO |
| 2014-05-24 | Name : The remote SuSE 11 host is missing one or more security updates. File : suse_11_finch-140508.nasl - Type : ACT_GATHER_INFO |
| 2014-05-19 | Name : The remote Gentoo host is missing one or more security-related patches. File : gentoo_GLSA-201405-22.nasl - Type : ACT_GATHER_INFO |
| 2014-02-24 | Name : The remote Fedora host is missing a security update. File : fedora_2014-2341.nasl - Type : ACT_GATHER_INFO |
| 2014-02-19 | Name : The remote Mandriva Linux host is missing one or more security updates. File : mandriva_MDVSA-2014-039.nasl - Type : ACT_GATHER_INFO |
| 2014-02-17 | Name : The remote Fedora host is missing a security update. File : fedora_2014-1999.nasl - Type : ACT_GATHER_INFO |
| 2014-02-17 | Name : The remote Fedora host is missing a security update. File : fedora_2014-2391.nasl - Type : ACT_GATHER_INFO |
| 2014-02-12 | Name : The remote Debian host is missing a security-related update. File : debian_DSA-2859.nasl - Type : ACT_GATHER_INFO |
| 2014-02-11 | Name : The remote Ubuntu host is missing a security-related patch. File : ubuntu_USN-2101-1.nasl - Type : ACT_GATHER_INFO |
| 2014-02-07 | Name : The remote Ubuntu host is missing one or more security-related patches. File : ubuntu_USN-2100-1.nasl - Type : ACT_GATHER_INFO |
| 2014-02-07 | Name : The remote Debian host is missing a security-related update. File : debian_DSA-2852.nasl - Type : ACT_GATHER_INFO |
| 2014-02-06 | Name : The remote Scientific Linux host is missing one or more security updates. File : sl_20140205_pidgin_on_SL5_x.nasl - Type : ACT_GATHER_INFO |
| 2014-02-06 | Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2014-0139.nasl - Type : ACT_GATHER_INFO |
| 2014-02-06 | Name : The remote Oracle Linux host is missing one or more security updates. File : oraclelinux_ELSA-2014-0139.nasl - Type : ACT_GATHER_INFO |
| 2014-02-06 | Name : The remote Fedora host is missing a security update. File : fedora_2014-2013.nasl - Type : ACT_GATHER_INFO |
| 2014-02-06 | Name : The remote CentOS host is missing one or more security updates. File : centos_RHSA-2014-0139.nasl - Type : ACT_GATHER_INFO |
| 2014-02-04 | Name : The remote Slackware host is missing a security update. File : Slackware_SSA_2014-034-01.nasl - Type : ACT_GATHER_INFO |
| 2014-02-04 | Name : An instant messaging client installed on the remote Windows host is affected ... File : pidgin_2_10_8.nasl - Type : ACT_GATHER_INFO |
Alert History
| Date | Informations |
|---|---|
| 2014-03-20 00:18:33 |
|
| 2014-02-17 11:32:33 |
|
| 2014-02-10 21:20:26 |
|
