Executive Summary
| Informations | |||
|---|---|---|---|
| Name | MDVSA-2011:183 | First vendor Publication | 2011-12-10 |
| Vendor | Mandriva | Last vendor Modification | 2011-12-10 |
| Severity (Vendor) | N/A | Revision | N/A |
Security-Database Scoring CVSS v3
| Cvss vector : N/A | |||
|---|---|---|---|
| Overall CVSS Score | NA | ||
| Base Score | NA | Environmental Score | NA |
| impact SubScore | NA | Temporal Score | NA |
| Exploitabality Sub Score | NA | ||
| Calculate full CVSS 3.0 Vectors scores | |||
Security-Database Scoring CVSS v2
| Cvss vector : (AV:N/AC:L/Au:N/C:N/I:N/A:P) | |||
|---|---|---|---|
| Cvss Base Score | 5 | Attack Range | Network |
| Cvss Impact Score | 2.9 | Attack Complexity | Low |
| Cvss Expoit Score | 10 | Authentication | None Required |
| Calculate full CVSS 2.0 Vectors scores | |||
Detail
| Multiple vulnerabilities has been discovered and corrected in pidgin: When receiving various stanzas related to voice and video chat, the XMPP protocol plugin failed to ensure that the incoming message contained all required fields, and would crash if certain fields were missing. When receiving various messages related to requesting or receiving authorization for adding a buddy to a buddy list, the oscar protocol plugin failed to validate that a piece of text was UTF-8. In some cases invalid UTF-8 data would lead to a crash (CVE-2011-4601). When receiving various incoming messages, the SILC protocol plugin failed to validate that a piece of text was UTF-8. In some cases invalid UTF-8 data would lead to a crash (CVE-2011-3594). This update provides pidgin 2.10.1, which is not vulnerable to these issues. |
Original Source
| Url : http://www.mandriva.com/security/advisories?name=MDVSA-2011:183 |
CWE : Common Weakness Enumeration
| % | Id | Name |
|---|---|---|
| 50 % | CWE-119 | Failure to Constrain Operations within the Bounds of a Memory Buffer |
| 50 % | CWE-20 | Improper Input Validation |
OVAL Definitions
| Definition Id: oval:org.mitre.oval:def:15080 | |||
| Oval ID: | oval:org.mitre.oval:def:15080 | ||
| Title: | USN-1273-1 -- Pidgin vulnerabilities | ||
| Description: | pidgin: multi-protocol instant messaging client Pidgin could be made to crash if it received specially crafted network traffic. | ||
| Family: | unix | Class: | patch |
| Reference(s): | USN-1273-1 CVE-2011-1091 CVE-2011-3184 CVE-2011-3594 | Version: | 7 |
| Platform(s): | Ubuntu 11.04 Ubuntu 10.04 Ubuntu 10.10 | Product(s): | Pidgin |
| Definition Synopsis: | |||
| |||
| Definition Id: oval:org.mitre.oval:def:18034 | |||
| Oval ID: | oval:org.mitre.oval:def:18034 | ||
| Title: | The g_markup_escape_text function in the SILC protocol plug-in in libpurple 2.10.0 and earlier, as used in Pidgin and possibly other products, allows remote attackers to cause a denial of service (crash) via invalid UTF-8 sequences that trigger use of invalid pointers and an out-of-bounds read, related to interactions with certain versions of glib2 | ||
| Description: | The g_markup_escape_text function in the SILC protocol plug-in in libpurple 2.10.0 and earlier, as used in Pidgin and possibly other products, allows remote attackers to cause a denial of service (crash) via invalid UTF-8 sequences that trigger use of invalid pointers and an out-of-bounds read, related to interactions with certain versions of glib2. | ||
| Family: | windows | Class: | vulnerability |
| Reference(s): | CVE-2011-3594 | Version: | 3 |
| Platform(s): | Microsoft Windows 2000 Microsoft Windows 7 Microsoft Windows Server 2003 Microsoft Windows Server 2008 Microsoft Windows Server 2008 R2 Microsoft Windows Vista Microsoft Windows XP Microsoft Windows 8 Microsoft Windows Server 2012 | Product(s): | Pidgin |
| Definition Synopsis: | |||
| Definition Id: oval:org.mitre.oval:def:18408 | |||
| Oval ID: | oval:org.mitre.oval:def:18408 | ||
| Title: | family_feedbag.c in the oscar protocol plugin in libpurple in Pidgin before 2.10.1 does not perform the expected UTF-8 validation on message data, which allows remote attackers to cause a denial of service (application crash) via a crafted (1) AIM or (2) ICQ message associated with buddy-list addition | ||
| Description: | family_feedbag.c in the oscar protocol plugin in libpurple in Pidgin before 2.10.1 does not perform the expected UTF-8 validation on message data, which allows remote attackers to cause a denial of service (application crash) via a crafted (1) AIM or (2) ICQ message associated with buddy-list addition. | ||
| Family: | windows | Class: | vulnerability |
| Reference(s): | CVE-2011-4601 | Version: | 3 |
| Platform(s): | Microsoft Windows 2000 Microsoft Windows 7 Microsoft Windows Server 2003 Microsoft Windows Server 2008 Microsoft Windows Server 2008 R2 Microsoft Windows Vista Microsoft Windows XP Microsoft Windows 8 Microsoft Windows Server 2012 | Product(s): | Pidgin |
| Definition Synopsis: | |||
| Definition Id: oval:org.mitre.oval:def:21773 | |||
| Oval ID: | oval:org.mitre.oval:def:21773 | ||
| Title: | RHSA-2011:1371: pidgin security update (Moderate) | ||
| Description: | The g_markup_escape_text function in the SILC protocol plug-in in libpurple 2.10.0 and earlier, as used in Pidgin and possibly other products, allows remote attackers to cause a denial of service (crash) via invalid UTF-8 sequences that trigger use of invalid pointers and an out-of-bounds read, related to interactions with certain versions of glib2. | ||
| Family: | unix | Class: | patch |
| Reference(s): | RHSA-2011:1371-01 CESA-2011:1371 CVE-2011-1091 CVE-2011-3594 | Version: | 29 |
| Platform(s): | Red Hat Enterprise Linux 5 CentOS Linux 5 | Product(s): | pidgin |
| Definition Synopsis: | |||
| |||
| Definition Id: oval:org.mitre.oval:def:23128 | |||
| Oval ID: | oval:org.mitre.oval:def:23128 | ||
| Title: | ELSA-2011:1371: pidgin security update (Moderate) | ||
| Description: | The g_markup_escape_text function in the SILC protocol plug-in in libpurple 2.10.0 and earlier, as used in Pidgin and possibly other products, allows remote attackers to cause a denial of service (crash) via invalid UTF-8 sequences that trigger use of invalid pointers and an out-of-bounds read, related to interactions with certain versions of glib2. | ||
| Family: | unix | Class: | patch |
| Reference(s): | ELSA-2011:1371-01 CVE-2011-1091 CVE-2011-3594 | Version: | 13 |
| Platform(s): | Oracle Linux 5 | Product(s): | pidgin |
| Definition Synopsis: | |||
| |||
CPE : Common Platform Enumeration
OpenVAS Exploits
| Date | Description |
|---|---|
| 2012-08-30 | Name : Fedora Update for pidgin FEDORA-2012-8669 File : nvt/gb_fedora_2012_8669_pidgin_fc15.nasl |
| 2012-08-10 | Name : Gentoo Security Advisory GLSA 201206-11 (Pidgin) File : nvt/glsa_201206_11.nasl |
| 2012-07-30 | Name : CentOS Update for finch CESA-2011:1371 centos4 x86_64 File : nvt/gb_CESA-2011_1371_finch_centos4_x86_64.nasl |
| 2012-07-30 | Name : CentOS Update for finch CESA-2011:1371 centos5 x86_64 File : nvt/gb_CESA-2011_1371_finch_centos5_x86_64.nasl |
| 2012-07-30 | Name : CentOS Update for finch CESA-2011:1820 centos4 x86_64 File : nvt/gb_CESA-2011_1820_finch_centos4_x86_64.nasl |
| 2012-07-30 | Name : CentOS Update for finch CESA-2011:1820 centos5 x86_64 File : nvt/gb_CESA-2011_1820_finch_centos5_x86_64.nasl |
| 2012-07-30 | Name : CentOS Update for finch CESA-2011:1821 centos6 File : nvt/gb_CESA-2011_1821_finch_centos6.nasl |
| 2012-07-16 | Name : Fedora Update for pidgin FEDORA-2012-10294 File : nvt/gb_fedora_2012_10294_pidgin_fc16.nasl |
| 2012-07-10 | Name : Ubuntu Update for pidgin USN-1500-1 File : nvt/gb_ubuntu_USN_1500_1.nasl |
| 2012-07-09 | Name : RedHat Update for pidgin RHSA-2011:1821-01 File : nvt/gb_RHSA-2011_1821-01_pidgin.nasl |
| 2012-06-11 | Name : Fedora Update for pidgin FEDORA-2012-8686 File : nvt/gb_fedora_2012_8686_pidgin_fc16.nasl |
| 2012-04-02 | Name : Fedora Update for pidgin FEDORA-2012-4600 File : nvt/gb_fedora_2012_4600_pidgin_fc15.nasl |
| 2012-04-02 | Name : Fedora Update for pidgin FEDORA-2011-17558 File : nvt/gb_fedora_2011_17558_pidgin_fc16.nasl |
| 2012-03-26 | Name : Fedora Update for pidgin FEDORA-2012-4595 File : nvt/gb_fedora_2012_4595_pidgin_fc16.nasl |
| 2012-01-09 | Name : Fedora Update for pidgin FEDORA-2011-17546 File : nvt/gb_fedora_2011_17546_pidgin_fc15.nasl |
| 2011-12-21 | Name : Pidgin XMPP And SILC Protocols Denial of Service Vulnerabilities (Win) File : nvt/secpod_pidgin_xmpp_and_silc_protocol_dos_vuln_win.nasl |
| 2011-12-16 | Name : RedHat Update for pidgin RHSA-2011:1820-01 File : nvt/gb_RHSA-2011_1820-01_pidgin.nasl |
| 2011-12-16 | Name : CentOS Update for finch CESA-2011:1820 centos5 i386 File : nvt/gb_CESA-2011_1820_finch_centos5_i386.nasl |
| 2011-12-16 | Name : CentOS Update for finch CESA-2011:1820 centos4 i386 File : nvt/gb_CESA-2011_1820_finch_centos4_i386.nasl |
| 2011-12-12 | Name : Mandriva Update for pidgin MDVSA-2011:183 (pidgin) File : nvt/gb_mandriva_MDVSA_2011_183.nasl |
| 2011-11-25 | Name : Ubuntu Update for pidgin USN-1273-1 File : nvt/gb_ubuntu_USN_1273_1.nasl |
| 2011-11-11 | Name : CentOS Update for finch CESA-2011:1371 centos4 i386 File : nvt/gb_CESA-2011_1371_finch_centos4_i386.nasl |
| 2011-10-18 | Name : CentOS Update for finch CESA-2011:1371 centos5 i386 File : nvt/gb_CESA-2011_1371_finch_centos5_i386.nasl |
| 2011-10-14 | Name : RedHat Update for pidgin RHSA-2011:1371-01 File : nvt/gb_RHSA-2011_1371-01_pidgin.nasl |
Open Source Vulnerability Database (OSVDB)
| Id | Description |
|---|---|
| 77749 | Pidgin libpurple/protocols/oscar/family_feedbag.c Oscar Protocol Buddy Additi... |
| 75994 | Pidgin libpurple/protocols/silc/ops.c silc_private_message() Function Out-of-... |
Nessus® Vulnerability Scanner
| Date | Description |
|---|---|
| 2014-06-13 | Name : The remote openSUSE host is missing a security update. File : suse_11_4_finch-111219.nasl - Type : ACT_GATHER_INFO |
| 2014-06-13 | Name : The remote openSUSE host is missing a security update. File : suse_11_4_finch-111128.nasl - Type : ACT_GATHER_INFO |
| 2014-06-13 | Name : The remote openSUSE host is missing a security update. File : suse_11_3_finch-111219.nasl - Type : ACT_GATHER_INFO |
| 2014-06-13 | Name : The remote openSUSE host is missing a security update. File : suse_11_3_finch-111128.nasl - Type : ACT_GATHER_INFO |
| 2014-06-13 | Name : The remote openSUSE host is missing a security update. File : openSUSE-2012-29.nasl - Type : ACT_GATHER_INFO |
| 2014-06-13 | Name : The remote openSUSE host is missing a security update. File : openSUSE-2011-35.nasl - Type : ACT_GATHER_INFO |
| 2013-07-12 | Name : The remote Oracle Linux host is missing one or more security updates. File : oraclelinux_ELSA-2011-1371.nasl - Type : ACT_GATHER_INFO |
| 2013-07-12 | Name : The remote Oracle Linux host is missing one or more security updates. File : oraclelinux_ELSA-2011-1820.nasl - Type : ACT_GATHER_INFO |
| 2013-07-12 | Name : The remote Oracle Linux host is missing one or more security updates. File : oraclelinux_ELSA-2011-1821.nasl - Type : ACT_GATHER_INFO |
| 2012-08-01 | Name : The remote Scientific Linux host is missing one or more security updates. File : sl_20111214_pidgin_on_SL4_x.nasl - Type : ACT_GATHER_INFO |
| 2012-08-01 | Name : The remote Scientific Linux host is missing one or more security updates. File : sl_20111214_pidgin_on_SL6_x.nasl - Type : ACT_GATHER_INFO |
| 2012-08-01 | Name : The remote Scientific Linux host is missing one or more security updates. File : sl_20111013_pidgin_on_SL4_x.nasl - Type : ACT_GATHER_INFO |
| 2012-07-10 | Name : The remote Ubuntu host is missing one or more security-related patches. File : ubuntu_USN-1500-1.nasl - Type : ACT_GATHER_INFO |
| 2012-06-22 | Name : The remote Gentoo host is missing one or more security-related patches. File : gentoo_GLSA-201206-11.nasl - Type : ACT_GATHER_INFO |
| 2012-01-10 | Name : The remote SuSE 11 host is missing one or more security updates. File : suse_11_finch-111226.nasl - Type : ACT_GATHER_INFO |
| 2012-01-10 | Name : The remote SuSE 10 host is missing a security-related patch. File : suse_finch-7901.nasl - Type : ACT_GATHER_INFO |
| 2012-01-09 | Name : The remote Fedora host is missing a security update. File : fedora_2011-17546.nasl - Type : ACT_GATHER_INFO |
| 2012-01-06 | Name : The remote Fedora host is missing a security update. File : fedora_2011-17558.nasl - Type : ACT_GATHER_INFO |
| 2011-12-23 | Name : The remote CentOS host is missing one or more security updates. File : centos_RHSA-2011-1821.nasl - Type : ACT_GATHER_INFO |
| 2011-12-15 | Name : The remote CentOS host is missing one or more security updates. File : centos_RHSA-2011-1820.nasl - Type : ACT_GATHER_INFO |
| 2011-12-15 | Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2011-1820.nasl - Type : ACT_GATHER_INFO |
| 2011-12-15 | Name : An instant messaging client installed on the remote Windows host is potential... File : pidgin_2_10_1.nasl - Type : ACT_GATHER_INFO |
| 2011-12-15 | Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2011-1821.nasl - Type : ACT_GATHER_INFO |
| 2011-12-13 | Name : The remote SuSE 10 host is missing a security-related patch. File : suse_finch-7827.nasl - Type : ACT_GATHER_INFO |
| 2011-12-13 | Name : The remote SuSE 11 host is missing one or more security updates. File : suse_11_finch-111105.nasl - Type : ACT_GATHER_INFO |
| 2011-12-13 | Name : The remote SuSE 11 host is missing one or more security updates. File : suse_11_finch-111104.nasl - Type : ACT_GATHER_INFO |
| 2011-12-12 | Name : The remote Mandriva Linux host is missing one or more security updates. File : mandriva_MDVSA-2011-183.nasl - Type : ACT_GATHER_INFO |
| 2011-11-22 | Name : The remote Ubuntu host is missing a security-related patch. File : ubuntu_USN-1273-1.nasl - Type : ACT_GATHER_INFO |
| 2011-10-17 | Name : The remote CentOS host is missing one or more security updates. File : centos_RHSA-2011-1371.nasl - Type : ACT_GATHER_INFO |
| 2011-10-14 | Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2011-1371.nasl - Type : ACT_GATHER_INFO |
Alert History
| Date | Informations |
|---|---|
| 2014-02-17 11:42:36 |
|
