Hash: SHA1
- ------------------------------------------------------------------------
Debian Security Advisory DSA-2038-2 security@debian.org
http://www.debian.org/security/ Thijs Kinkhorst
May 17, 2010 http://www.debian.org/security/faq
- ------------------------------------------------------------------------
Package : pidgin
Vulnerability : several
Problem type : remote
Debian-specific: no
CVE Id(s) : CVE-2010-0420 CVE-2010-0423
Debian Bug : 566775 579601
The packages for Pidgin released as DSA 2038-1 had a regression, as they
unintentionally disabled the Zephyr instant messaging protocol. This
update restores Zephyr functionality. For reference the original
advisory text below.
Several remote vulnerabilities have been discovered in Pidgin, a multi
protocol instant messaging client. The Common Vulnerabilities and
Exposures project identifies the following problems:
CVE-2010-0420
Crafted nicknames in the XMPP protocol can crash Pidgin remotely.
CVE-2010-0423
Remote contacts may send too many custom smilies, crashing Pidgin.
Since a few months, Microsoft's servers for MSN have changed the protocol,
making Pidgin non-functional for use with MSN. It is not feasible to port
these changes to the version of Pidgin in Debian Lenny. This update
formalises that situation by disabling the protocol in the client. Users
of the MSN protocol are advised to use the version of Pidgin in the
repositories of www.backports.org.
For the stable distribution (lenny), these problems have been fixed in
version 2.4.3-4lenny7.
For the unstable distribution (sid), these problems have been fixed in
version 2.6.6-1.
We recommend that you upgrade your pidgin package.
Upgrade instructions
- --------------------
wget url
will fetch the file for you
dpkg -i file.deb
will install the referenced file.
If you are using the apt-get package manager, use the line for
sources.list as given below:
apt-get update
will update the internal database
apt-get upgrade
will install corrected packages
You may use an automated update by adding the resources from the
footer to the proper configuration.
Debian GNU/Linux 5.0 alias lenny
- --------------------------------
Source archives:
http://security.debian.org/pool/updates/main/p/pidgin/pidgin_2.4.3.orig.tar.gz
Size/MD5 checksum: 13123610 d0e0bd218fbc67df8b2eca2f21fcd427
http://security.debian.org/pool/updates/main/p/pidgin/pidgin_2.4.3-4lenny7.diff.gz
Size/MD5 checksum: 72195 fe0a9dd9d55d642dc77c4f7c678522c8
http://security.debian.org/pool/updates/main/p/pidgin/pidgin_2.4.3-4lenny7.dsc
Size/MD5 checksum: 1784 300f72738867fcd326db7f836ac47d67
Architecture independent packages:
http://security.debian.org/pool/updates/main/p/pidgin/pidgin-data_2.4.3-4lenny7_all.deb
Size/MD5 checksum: 7019174 3d1e4508e5543441a5d04a31f03b0979
http://security.debian.org/pool/updates/main/p/pidgin/pidgin-dev_2.4.3-4lenny7_all.deb
Size/MD5 checksum: 193842 b2c75fc6891adad16add69903ce9762d
http://security.debian.org/pool/updates/main/p/pidgin/finch-dev_2.4.3-4lenny7_all.deb
Size/MD5 checksum: 159766 5bb66c4efe6c67eeb33297738799a831
http://security.debian.org/pool/updates/main/p/pidgin/libpurple-bin_2.4.3-4lenny7_all.deb
Size/MD5 checksum: 133930 c25806d1d9a07c49c5a3b2fd0b83964c
http://security.debian.org/pool/updates/main/p/pidgin/libpurple-dev_2.4.3-4lenny7_all.deb
Size/MD5 checksum: 277224 c169cf3a82bb6a0faf1d285a7377b695
alpha architecture (DEC Alpha)
http://security.debian.org/pool/updates/main/p/pidgin/libpurple0_2.4.3-4lenny7_alpha.deb
Size/MD5 checksum: 1501864 9aa23188e1610834d035e88fd30308b8
http://security.debian.org/pool/updates/main/p/pidgin/finch_2.4.3-4lenny7_alpha.deb
Size/MD5 checksum: 369772 a8eb912226cf47f5f74892f0b1110cc4
http://security.debian.org/pool/updates/main/p/pidgin/pidgin_2.4.3-4lenny7_alpha.deb
Size/MD5 checksum: 776646 bf0f80658559ab3e4c22356dd47d809d
http://security.debian.org/pool/updates/main/p/pidgin/pidgin-dbg_2.4.3-4lenny7_alpha.deb
Size/MD5 checksum: 4989752 30e054746fff6d56a9e3b288039ff6c9
amd64 architecture (AMD x86_64 (AMD64))
http://security.debian.org/pool/updates/main/p/pidgin/pidgin_2.4.3-4lenny7_amd64.deb
Size/MD5 checksum: 727950 57554918978a95ea250a8494c9aab433
http://security.debian.org/pool/updates/main/p/pidgin/libpurple0_2.4.3-4lenny7_amd64.deb
Size/MD5 checksum: 1429960 2779007da91fe74a1304f3263cd7d53e
http://security.debian.org/pool/updates/main/p/pidgin/finch_2.4.3-4lenny7_amd64.deb
Size/MD5 checksum: 348100 d01043df40ed1861c63043b44289984d
http://security.debian.org/pool/updates/main/p/pidgin/pidgin-dbg_2.4.3-4lenny7_amd64.deb
Size/MD5 checksum: 5101892 af2ea1456eb390f3930e6164108a9c7f
arm architecture (ARM)
http://security.debian.org/pool/updates/main/p/pidgin/finch_2.4.3-4lenny7_arm.deb
Size/MD5 checksum: 316624 290e5d8fa14bcc09dde3ce6d326d84bd
http://security.debian.org/pool/updates/main/p/pidgin/pidgin_2.4.3-4lenny7_arm.deb
Size/MD5 checksum: 657416 1997d30109a1c86c6c8979ff2e0511ee
http://security.debian.org/pool/updates/main/p/pidgin/pidgin-dbg_2.4.3-4lenny7_arm.deb
Size/MD5 checksum: 4835872 9f2aaef6679c3b2e27a73240799a7ffa
http://security.debian.org/pool/updates/main/p/pidgin/libpurple0_2.4.3-4lenny7_arm.deb
Size/MD5 checksum: 1239516 640fd3ff6c91ac45820581df86965af8
armel architecture (ARM EABI)
http://security.debian.org/pool/updates/main/p/pidgin/pidgin_2.4.3-4lenny7_armel.deb
Size/MD5 checksum: 668000 b0bc286a8e2d74a033ac69b5ed234e6e
http://security.debian.org/pool/updates/main/p/pidgin/libpurple0_2.4.3-4lenny7_armel.deb
Size/MD5 checksum: 1243880 88c529b8e9178969c3a3a13e1a8e3230
http://security.debian.org/pool/updates/main/p/pidgin/finch_2.4.3-4lenny7_armel.deb
Size/MD5 checksum: 319962 72d956d2c3b6b04dc0aed07e6d99e944
http://security.debian.org/pool/updates/main/p/pidgin/pidgin-dbg_2.4.3-4lenny7_armel.deb
Size/MD5 checksum: 4851712 6134571c92b5495489555c01fc4a6d51
hppa architecture (HP PA RISC)
http://security.debian.org/pool/updates/main/p/pidgin/libpurple0_2.4.3-4lenny7_hppa.deb
Size/MD5 checksum: 1522820 023def8c7a3051e1d15030347c99e99d
http://security.debian.org/pool/updates/main/p/pidgin/pidgin_2.4.3-4lenny7_hppa.deb
Size/MD5 checksum: 752858 43129b10ef60136293b349614a662972
http://security.debian.org/pool/updates/main/p/pidgin/pidgin-dbg_2.4.3-4lenny7_hppa.deb
Size/MD5 checksum: 4943738 9cc7aee5d06445b07cceb81efa3ba30d
http://security.debian.org/pool/updates/main/p/pidgin/finch_2.4.3-4lenny7_hppa.deb
Size/MD5 checksum: 360748 353f5caf6903c89a3bdd482dd6a520e6
i386 architecture (Intel ia32)
http://security.debian.org/pool/updates/main/p/pidgin/pidgin_2.4.3-4lenny7_i386.deb
Size/MD5 checksum: 681390 82c10195fb937a47a113940fa93dbdb5
http://security.debian.org/pool/updates/main/p/pidgin/pidgin-dbg_2.4.3-4lenny7_i386.deb
Size/MD5 checksum: 4837960 416ddcf7b18e7b2a474fa56731a93f7b
http://security.debian.org/pool/updates/main/p/pidgin/finch_2.4.3-4lenny7_i386.deb
Size/MD5 checksum: 326994 06bb2fefdc9ea9dce38a5481f33dcdf5
http://security.debian.org/pool/updates/main/p/pidgin/libpurple0_2.4.3-4lenny7_i386.deb
Size/MD5 checksum: 1317496 9218b0b46b8716781d80133e77194170
ia64 architecture (Intel ia64)
http://security.debian.org/pool/updates/main/p/pidgin/libpurple0_2.4.3-4lenny7_ia64.deb
Size/MD5 checksum: 1821990 87c03b5c08d97b8c8ae2a573ecd3cecb
http://security.debian.org/pool/updates/main/p/pidgin/finch_2.4.3-4lenny7_ia64.deb
Size/MD5 checksum: 435010 22dee93a1714c2654ec0dfaa8705cfe2
http://security.debian.org/pool/updates/main/p/pidgin/pidgin-dbg_2.4.3-4lenny7_ia64.deb
Size/MD5 checksum: 4706272 6e0b0c3291dceb229522e1de229e3361
http://security.debian.org/pool/updates/main/p/pidgin/pidgin_2.4.3-4lenny7_ia64.deb
Size/MD5 checksum: 948766 ddf4cff0ac25735e5d18edcbeb970bf4
mips architecture (MIPS (Big Endian))
http://security.debian.org/pool/updates/main/p/pidgin/libpurple0_2.4.3-4lenny7_mips.deb
Size/MD5 checksum: 1117676 eb4a88cc934233faafebdcebc1171bc3
http://security.debian.org/pool/updates/main/p/pidgin/finch_2.4.3-4lenny7_mips.deb
Size/MD5 checksum: 319576 4ad4d7a878a0d5daaff189da549c4638
http://security.debian.org/pool/updates/main/p/pidgin/pidgin-dbg_2.4.3-4lenny7_mips.deb
Size/MD5 checksum: 5087780 9ebfc36f1749b61ab7a4fe70d0770f88
http://security.debian.org/pool/updates/main/p/pidgin/pidgin_2.4.3-4lenny7_mips.deb
Size/MD5 checksum: 654936 d63bd6a67138596ef85b7a3259fceee7
mipsel architecture (MIPS (Little Endian))
http://security.debian.org/pool/updates/main/p/pidgin/pidgin-dbg_2.4.3-4lenny7_mipsel.deb
Size/MD5 checksum: 4999390 ad6121a42731cb360d76b6fe67180924
http://security.debian.org/pool/updates/main/p/pidgin/finch_2.4.3-4lenny7_mipsel.deb
Size/MD5 checksum: 318598 8b0b8f40209b828098f6ed000c517f65
http://security.debian.org/pool/updates/main/p/pidgin/libpurple0_2.4.3-4lenny7_mipsel.deb
Size/MD5 checksum: 1108760 4e9f79966b7fa0df677a1a5952488e62
http://security.debian.org/pool/updates/main/p/pidgin/pidgin_2.4.3-4lenny7_mipsel.deb
Size/MD5 checksum: 651474 7b24d4210caaf4d27b9b3863393bffd6
powerpc architecture (PowerPC)
http://security.debian.org/pool/updates/main/p/pidgin/libpurple0_2.4.3-4lenny7_powerpc.deb
Size/MD5 checksum: 1470622 c51b3531cc31005e58feac25f8606bd3
http://security.debian.org/pool/updates/main/p/pidgin/pidgin-dbg_2.4.3-4lenny7_powerpc.deb
Size/MD5 checksum: 5052846 986c8a8ac0ccd3399393bceda957656f
http://security.debian.org/pool/updates/main/p/pidgin/finch_2.4.3-4lenny7_powerpc.deb
Size/MD5 checksum: 362770 f00c1a33b3598333dfc4ae9d61bf1d83
http://security.debian.org/pool/updates/main/p/pidgin/pidgin_2.4.3-4lenny7_powerpc.deb
Size/MD5 checksum: 755104 ae81b0387a32b162fb30ac425dc4ad43
s390 architecture (IBM S/390)
http://security.debian.org/pool/updates/main/p/pidgin/pidgin-dbg_2.4.3-4lenny7_s390.deb
Size/MD5 checksum: 5014182 c093e4c7e6e3b6132a8145a35e88c3fb
http://security.debian.org/pool/updates/main/p/pidgin/finch_2.4.3-4lenny7_s390.deb
Size/MD5 checksum: 359260 919eb5ad29cb280d84ef36b2c45273b9
http://security.debian.org/pool/updates/main/p/pidgin/libpurple0_2.4.3-4lenny7_s390.deb
Size/MD5 checksum: 1351418 a94314c09692e3a9350b8bd1684843bc
http://security.debian.org/pool/updates/main/p/pidgin/pidgin_2.4.3-4lenny7_s390.deb
Size/MD5 checksum: 718026 52121ab6cf237545c29f10826b98894b
sparc architecture (Sun SPARC/UltraSPARC)
http://security.debian.org/pool/updates/main/p/pidgin/pidgin-dbg_2.4.3-4lenny7_sparc.deb
Size/MD5 checksum: 4639296 f38822c989d40d124d82abc53ae42d38
http://security.debian.org/pool/updates/main/p/pidgin/finch_2.4.3-4lenny7_sparc.deb
Size/MD5 checksum: 328662 f5fe4eb9c81b2aa8d335b983288902dd
http://security.debian.org/pool/updates/main/p/pidgin/pidgin_2.4.3-4lenny7_sparc.deb
Size/MD5 checksum: 683246 d37d198e8bb1d5c3f98521dcc0a43c24
http://security.debian.org/pool/updates/main/p/pidgin/libpurple0_2.4.3-4lenny7_sparc.deb
Size/MD5 checksum: 1323820 54026420c5be2e153e7a8ffbcb70b5cd
These files will probably be moved into the stable distribution on
its next update.
- ---------------------------------------------------------------------------------
For apt-get: deb http://security.debian.org/ stable/updates main
For dpkg-ftp: ftp://security.debian.org/debian-security dists/stable/updates/main
Mailing list: debian-security-announce@lists.debian.org
Package info: `apt-cache show <pkg>' and http://packages.debian.org/<pkg>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.10 (GNU/Linux)
iQEcBAEBAgAGBQJL8ajrAAoJECIIoQCMVaAcxI0H/0Q4UHvj1XAmzt11lTuRsPrg
MtGbmdL0lXfCgMkgE6XPWRYQbS19ZI8gGXsRDp/vtFpNRY6bvyihmWtmaujvoh5/
dTS9DwdU+/jEDeaNzQh8nzUllJUwOa7TgjbtraBKMSGnZQIB8fhoiTtfn4ZN3NLs
4f6qucNc0YMgLpZ1uyGVzNJUzz0SzwfsVtkrQGlL3TNNZ/+8PwgTS/Yo+fxB7cc8
9DvZ7ARcThuL2vjIQsNZear0uwABrfjD0TpdHERHyWY2qBd+H0A1MGjpMoXlh0hF
5vopr4oHRRtKflaCoUWJeHRcwHa5gGO/XW7DdHTgk0OlIAiFFC7bEo1A6JInr04=
=ZQl4
-----END PGP SIGNATURE-----
--
To UNSUBSCRIBE, email to debian-security-announce-REQUEST@lists.debian.org
with a subject of "unsubscribe". Trouble? Contact listmaster@lists.debian.org
Archive: http://lists.debian.org/20100517203756.A7A3D3268BB@morgana.loeki.tv
No comments:
Post a Comment