pidgin: multiple vulnerabilities
| Package(s): | pidgin | CVE #(s): | CVE-2011-4939 CVE-2012-1178 | ||||||||||||||||||||||||||||||||||||||||
| Created: | April 2, 2012 | Updated: | March 15, 2013 | ||||||||||||||||||||||||||||||||||||||||
| Description: | From the Red Hat bugzilla entries [1, 2]: CVE-2011-4939: A NULL pointer dereference flaw was found in the way XMPP protocol plug-in of Pidgin, a Gtk+ based multiprotocol instant messaging client, performed change of user name for particular buddy. If a remote Pidgin user, present on the buddy list of the victim, changed their Pidgin nickname to specially-crafted value it would lead to Pidgin client crash. CVE-2012-1178: A denial of service flaw was found in the way MSN protocol plug-in of Pidgin, a Gtk+ based multiprotocol instant messaging client, performed sanitization of certain not UTF-8 encoded text prior its presentation. A remote attacker could send a specially-crafted not UTF-8 encoded text (for example via Offline Instant Message post), which once processed by the Pidgin client of the victim would lead to that Pidgin client abort. | ||||||||||||||||||||||||||||||||||||||||||
| Alerts: |
| ||||||||||||||||||||||||||||||||||||||||||