Pidgin 2.10.0 uses DBUS for certain cleartext communication, which allows local users to obtain sensitive information via a dbus session monitor.

The remote Redhat Enterprise Linux 4 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - pidgin: libpurple no way to restrict private messages from being sent over session dbus (CVE-2012-1257)

  - cipher.c in the Cipher API in libpurple in Pidgin before 2.7.10 retains encryption-key data in process     memory, which might allow local users to obtain sensitive information by reading a core file or other     representation of memory contents. (CVE-2011-4922)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

The remote Redhat Enterprise Linux 6 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - pidgin: Out-of-bounds write in purple_markup_unescape_entity triggered by invalid XML (CVE-2017-2640)

  - Pidgin 2.10.0 uses DBUS for certain cleartext communication, which allows local users to obtain sensitive     information via a dbus session monitor. (CVE-2012-1257)

  - The (1) bundled GnuTLS SSL/TLS plugin and the (2) bundled OpenSSL SSL/TLS plugin in libpurple in Pidgin     before 2.10.10 do not properly consider the Basic Constraints extension during verification of X.509     certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain     sensitive information via a crafted certificate. (CVE-2014-3694)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

The remote Redhat Enterprise Linux 5 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - pidgin: Out-of-bounds write in purple_markup_unescape_entity triggered by invalid XML (CVE-2017-2640)

  - cipher.c in the Cipher API in libpurple in Pidgin before 2.7.10 retains encryption-key data in process     memory, which might allow local users to obtain sensitive information by reading a core file or other     representation of memory contents. (CVE-2011-4922)

  - Pidgin 2.10.0 uses DBUS for certain cleartext communication, which allows local users to obtain sensitive     information via a dbus session monitor. (CVE-2012-1257)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

ID	Name	Product	Family	Severity
199382	RHEL 4 : pidgin (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	medium
199367	RHEL 6 : pidgin (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	critical
199298	RHEL 5 : pidgin (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	critical

Detections

Analytics

CVE-2012-1257

medium

Tenable Plugins

medium

critical

critical