Debian Security Advisory

DLA-542-1 pidgin -- LTS security update

Date Reported:
04 Jul 2016
Affected Packages:
pidgin
Vulnerable:
Yes
Security database references:
In Mitre's CVE dictionary: CVE-2016-2365, CVE-2016-2366, CVE-2016-2367, CVE-2016-2368, CVE-2016-2369, CVE-2016-2370, CVE-2016-2371, CVE-2016-2372, CVE-2016-2373, CVE-2016-2374, CVE-2016-2375, CVE-2016-2376, CVE-2016-2377, CVE-2016-2378, CVE-2016-2380, CVE-2016-4323.
More information:

Numerous security issues have been identified and fixed in Pidgin in Debian/Wheezy.

  • CVE-2016-2365

    MXIT Markup Command Denial of Service Vulnerability

  • CVE-2016-2366

    MXIT Table Command Denial of Service Vulnerability

  • CVE-2016-2367

    MXIT Avatar Length Memory Disclosure Vulnerability

  • CVE-2016-2368

    MXIT g_snprintf Multiple Buffer Overflow Vulnerabilities

  • CVE-2016-2369

    MXIT CP_SOCK_REC_TERM Denial of Service Vulnerability

  • CVE-2016-2370

    MXIT Custom Resource Denial of Service Vulnerability

  • CVE-2016-2371

    MXIT Extended Profiles Code Execution Vulnerability

  • CVE-2016-2372

    MXIT File Transfer Length Memory Disclosure Vulnerability

  • CVE-2016-2373

    MXIT Contact Mood Denial of Service Vulnerability

  • CVE-2016-2374

    MXIT MultiMX Message Code Execution Vulnerability

  • CVE-2016-2375

    MXIT Suggested Contacts Memory Disclosure Vulnerability

  • CVE-2016-2376

    MXIT read stage 0x3 Code Execution Vulnerability

  • CVE-2016-2377

    MXIT HTTP Content-Length Buffer Overflow Vulnerability

  • CVE-2016-2378

    MXIT get_utf8_string Code Execution Vulnerability

  • CVE-2016-2380

    MXIT mxit_convert_markup_tx Information Leak Vulnerability

  • CVE-2016-4323

    MXIT Splash Image Arbitrary File Overwrite Vulnerability

For Debian 7 Wheezy, these problems have been fixed in version 2.10.10-1~deb7u2.

We recommend that you upgrade your pidgin packages.

Further information about Debian LTS security advisories, how to apply these updates to your system and frequently asked questions can be found at: https://wiki.debian.org/LTS