Integer overflow in libpurple/protocols/gg/lib/http.c in the Gadu-Gadu (gg) parser in Pidgin before 2.10.8 allows remote attackers to have an unspecified impact via a large Content-Length value, which triggers a buffer overflow.

The remote host is affected by the vulnerability described in GLSA-201508-02 (libgadu: Multiple vulnerabilities)

    libgadu contains multiple vulnerabilities:
      X.509 certificates are not properly validated (CVE-2013-4488)       A integer overflow error could lead to a buffer overflow         (CVE-2013-6487)       Malformed responses from a Gadu-Gadu file relay server are not         properly handled (CVE-2014-3775)   Impact :

    A remote attacker may be able to execute arbitrary code with the       privileges of the process, cause a Denial of Service condition, or spoof       servers.
  Workaround :

    There is no known workaround at this time.

The remote Solaris system is missing necessary patches to address security updates :

  - The Yahoo! protocol plugin in libpurple in Pidgin before     2.10.8 does not properly validate UTF-8 data, which     allows remote attackers to cause a denial of service     (application crash) via crafted byte sequences.
    (CVE-2012-6152)

  - The MXit protocol plugin in libpurple in Pidgin before     2.10.7 might allow remote attackers to create or     overwrite files via a crafted (1) mxit or (2)     mxit/imagestrips pathname. (CVE-2013-0271)

  - Buffer overflow in http.c in the MXit protocol plugin in     libpurple in Pidgin before 2.10.7 allows remote servers     to execute arbitrary code via a long HTTP header.
    (CVE-2013-0272)

  - sametime.c in the Sametime protocol plugin in libpurple     in Pidgin before 2.10.7 does not properly terminate long     user IDs, which allows remote servers to cause a denial     of service (application crash) via a crafted packet.
    (CVE-2013-0273)

  - upnp.c in libpurple in Pidgin before 2.10.7 does not     properly terminate long strings in UPnP responses, which     allows remote attackers to cause a denial of service     (application crash) by leveraging access to the local     network. (CVE-2013-0274)

  - Multiple integer signedness errors in libpurple in     Pidgin before 2.10.8 allow remote attackers to cause a     denial of service (application crash) via a crafted     timestamp value in an XMPP message. (CVE-2013-6477)

  - gtkimhtml.c in Pidgin before 2.10.8 does not properly     interact with underlying library support for wide Pango     layouts, which allows user-assisted remote attackers to     cause a denial of service (application crash) via a long     URL that is examined with a tooltip. (CVE-2013-6478)

  - util.c in libpurple in Pidgin before 2.10.8 does not     properly allocate memory for HTTP responses that are     inconsistent with the Content-Length header, which     allows remote HTTP servers to cause a denial of service     (application crash) via a crafted response.
    (CVE-2013-6479)

  - libpurple/protocols/yahoo/libymsg.c in Pidgin before     2.10.8 allows remote attackers to cause a denial of     service (crash) via a Yahoo! P2P message with a crafted     length field, which triggers a buffer over-read.
    (CVE-2013-6481)

  - Pidgin before 2.10.8 allows remote MSN servers to cause     a denial of service (NULL pointer dereference and crash)     via a crafted (1) SOAP response, (2) OIM XML response,     or (3) Content-Length header. (CVE-2013-6482)

  - The XMPP protocol plugin in libpurple in Pidgin before     2.10.8 does not properly determine whether the from     address in an iq reply is consistent with the to address     in an iq request, which allows remote attackers to spoof     iq traffic or cause a denial of service (NULL pointer     dereference and application crash) via a crafted reply.
    (CVE-2013-6483)

  - The STUN protocol implementation in libpurple in Pidgin     before 2.10.8 allows remote STUN servers to cause a     denial of service (out-of-bounds write operation and     application crash) by triggering a socket read error.
    (CVE-2013-6484)

  - Buffer overflow in util.c in libpurple in Pidgin before     2.10.8 allows remote HTTP servers to cause a denial of     service (application crash) or possibly have unspecified     other impact via an invalid chunk-size field in chunked     transfer-coding data. (CVE-2013-6485)

  - gtkutils.c in Pidgin before 2.10.8 on Windows allows     user-assisted remote attackers to execute arbitrary     programs via a message containing a file: URL that is     improperly handled during construction of an     explorer.exe command. NOTE: this vulnerability exists     because of an incomplete fix for CVE-2011-3185.
    (CVE-2013-6486)

  - Integer overflow in libpurple/protocols/gg/lib/http.c in     the Gadu-Gadu (gg) parser in Pidgin before 2.10.8 allows     remote attackers to have an unspecified impact via a     large Content-Length value, which triggers a buffer     overflow. (CVE-2013-6487)

  - Integer signedness error in the MXit functionality in     Pidgin before 2.10.8 allows remote attackers to cause a     denial of service (segmentation fault) via a crafted     emoticon value, which triggers an integer overflow and a     buffer overflow. (CVE-2013-6489)

  - The SIMPLE protocol functionality in Pidgin before     2.10.8 allows remote attackers to have an unspecified     impact via a negative Content-Length header, which     triggers a buffer overflow. (CVE-2013-6490)

  - The IRC protocol plugin in libpurple in Pidgin before     2.10.8 does not validate argument counts, which allows     remote IRC servers to cause a denial of service     (application crash) via a crafted message.
    (CVE-2014-0020)

- Update to version 1.11.4, bugfix release :

  + Fix buffer overflow with remote code execution     potential. Only triggerable by a Gadu-Gadu server or a     man-in-the-middle. CVE-2013-6487 (bnc#861019,     bnc#878540)

  + Fix memory overwrite in file transfer with proxy server.
    CVE-2014-3775 (bnc#878540)

  + Minor fixes reported by Pidgin project members.

- Update to version 2.10.8 (bnc#861019) :

  + General: Python build scripts and example plugins are     now compatible with Python 3 (pidgin.im#15624).

  + libpurple :

  - Fix potential crash if libpurple gets an error     attempting to read a reply from a STUN server     (CVE-2013-6484).

  - Fix potential crash parsing a malformed HTTP response     (CVE-2013-6479).

  - Fix buffer overflow when parsing a malformed HTTP     response with chunked Transfer-Encoding (CVE-2013-6485).

  - Better handling of HTTP proxy responses with negative     Content-Lengths.

  - Fix handling of SSL certificates without subjects when     using libnss.

  - Fix handling of SSL certificates with timestamps in the     distant future when using libnss (pidgin.im#15586).

  - Impose maximum download size for all HTTP fetches.

  + Pidgin :

  - Fix crash displaying tooltip of long URLs     (CVE-2013-6478).

  - Better handling of URLs longer than 1000 letters.

  - Fix handling of multibyte UTF-8 characters in smiley     themes (pidgin.im#15756).

  + AIM: Fix untrusted certificate error.

  + AIM and ICQ: Fix a possible crash when receiving a     malformed message in a Direct IM session.

  + Gadu-Gadu :

  - Fix buffer overflow with remote code execution     potential. Only triggerable by a Gadu-Gadu server or a     man-in-the-middle (CVE-2013-6487).

  - Disabled buddy list import/export from/to server.

  - Disabled new account registration and password change     options.

  + IRC :

  - Fix bug where a malicious server or man-in-the-middle     could trigger a crash by not sending enough arguments     with various messages (CVE-2014-0020).

  - Fix bug where initial IRC status would not be set     correctly.

  - Fix bug where IRC wasn't available when libpurple was     compiled with Cyrus SASL support (pidgin.im#15517).

  + MSN :

  - Fix NULL pointer dereference parsing headers in MSN     (CVE-2013-6482).

  - Fix NULL pointer dereference parsing OIM data in MSN     (CVE-2013-6482).

  - Fix NULL pointer dereference parsing SOAP data in MSN     (CVE-2013-6482).

  - Fix possible crash when sending very long messages. Not     remotely-triggerable.

  + MXit :

  - Fix buffer overflow with remote code execution potential     (CVE-2013-6487).

  - Fix sporadic crashes that can happen after user is     disconnected.

  - Fix crash when attempting to add a contact via search     results.

  - Show error message if file transfer fails.

  - Fix compiling with InstantBird.

  - Fix display of some custom emoticons.

  + SILC: Correctly set whiteboard dimensions in whiteboard     sessions.

  + SIMPLE: Fix buffer overflow with remote code execution     potential (CVE-2013-6487).

  + XMPP :

  - Prevent spoofing of iq replies by verifying that the     'from' address matches the 'to' address of the iq     request (CVE-2013-6483).

  - Fix crash on some systems when receiving fake delay     timestamps with extreme values (CVE-2013-6477).

  - Fix possible crash or other erratic behavior when     selecting a very small file for your own buddy icon.

  - Fix crash if the user tries to initiate a voice/video     session with a resourceless JID.

  - Fix login errors when the first two available auth     mechanisms fail but a subsequent mechanism would     otherwise work when using Cyrus SASL (pidgin.im#15524).

  - Fix dropping incoming stanzas on BOSH connections when     we receive multiple HTTP responses at once     (pidgin.im#15684).

  + Yahoo! :

  - Fix possible crashes handling incoming strings that are     not UTF-8 (CVE-2012-6152).

  - Fix a bug reading a peer to peer message where a remote     user could trigger a crash (CVE-2013-6481).

  + Plugins :

  - Fix crash in contact availability plugin.

  - Fix perl function Purple::Network::ip_atoi.

  - Add Unity integration plugin.

  + Windows specific fixes: (CVE-2013-6486, pidgin.im#15520,     pidgin.im#15521, bgo#668154).

  - Drop pidgin-irc-sasl.patch, fixed upstream.

  - Obsolete pidgin-facebookchat: the package is no longer     maintained and pidgin as built-in support for Facebook     Chat.

  - Protect buildrequires for mono-devel with with_mono     macro.

  - Add pidgin-gstreamer1.patch: Port to GStreamer 1.0. Only     enabled on openSUSE 13.1 and newer.

  - On openSUSE 13.1 and newer, use gstreamer-devel and     gstreamer-plugins-base-devel BuildRequires.

A memory corruption vulnerability has been fixed in libgadu.
CVE-2013-6487 has been assigned to this issue.

The pidgin Instant Messenger has been updated to fix various security issues :

  - Remotely triggerable crash in IRC argument parsing.
    (CVE-2014-0020)

  - Buffer overflow in SIMPLE header parsing.
    (CVE-2013-6490)

  - Buffer overflow in MXit emoticon parsing.
    (CVE-2013-6489)

  - Buffer overflow in Gadu-Gadu HTTP parsing.
    (CVE-2013-6487)

  - Pidgin uses clickable links to untrusted executables.
    (CVE-2013-6486)

  - Buffer overflow parsing chunked HTTP responses.
    (CVE-2013-6485)

  - Crash reading response from STUN server. (CVE-2013-6484)

  - XMPP doesn't verify 'from' on some iq replies.
    (CVE-2013-6483)

  - NULL pointer dereference parsing SOAP data in MSN.
    (CVE-2013-6482)

  - NULL pointer dereference parsing OIM data in MSN.
    (CVE-2013-6482)

  - NULL pointer dereference parsing headers in MSN.
    (CVE-2013-6482)

  - Remote crash reading Yahoo! P2P message. (CVE-2013-6481)

  - Remote crash parsing HTTP responses. (CVE-2013-6479)

  - Crash when hovering pointer over a long URL.
    (CVE-2013-6478)

  - Crash handling bad XMPP timestamp. (CVE-2013-6477)

  - Yahoo! remote crash from incorrect character encoding.
    (CVE-2012-6152)

The remote host is affected by the vulnerability described in GLSA-201405-22 (Pidgin: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Pidgin. Please review       the CVE identifiers referenced below for details.
  Impact :

    A remote attacker could possibly execute arbitrary code with the       privileges of the Pidgin process, cause a Denial of Service condition,       overwrite files, or spoof traffic.
  Workaround :

    There is no known workaround at this time.

Security vulnerability fix in HTTP protocol handling. A specially crafted server reply may cause memory overwrite and arbitrary code execution. (CVE-2013-6487).

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Updated libgadu packages fix security vulnerability :

A malicious server or man-in-the-middle could send a large value for Content-Length and cause an integer overflow which could lead to a buffer overflow in Gadu-Gadu HTTP parsing (CVE-2013-6487).

Update to 2.10.9

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Multiple vulnerabilities have been discovered in Pidgin, a multi-protocol instant messaging client :

  - CVE-2013-6477     Jaime Breva Ribes discovered that a remote XMPP user can     trigger a crash by sending a message with a timestamp in     the distant future.

  - CVE-2013-6478     Pidgin could be crashed through overly wide tooltip     windows.

  - CVE-2013-6479     Jacob Appelbaum discovered that a malicious server or a     'man in the middle' could send a malformed HTTP header     resulting in denial of service.

  - CVE-2013-6481     Daniel Atallah discovered that Pidgin could be crashed     through malformed Yahoo! P2P messages.

  - CVE-2013-6482     Fabian Yamaguchi and Christian Wressnegger discovered     that Pidgin could be crashed through malformed MSN     messages.

  - CVE-2013-6483     Fabian Yamaguchi and Christian Wressnegger discovered     that Pidgin could be crashed through malformed XMPP     messages.

  - CVE-2013-6484     It was discovered that incorrect error handling when     reading the response from a STUN server could result in     a crash.

  - CVE-2013-6485     Matt Jones discovered a buffer overflow in the parsing     of malformed HTTP responses.

  - CVE-2013-6487     Yves Younan and Ryan Pentney discovered a buffer     overflow when parsing Gadu-Gadu messages.

  - CVE-2013-6489     Yves Younan and Pawel Janic discovered an integer     overflow when parsing MXit emoticons.

  - CVE-2013-6490     Yves Younan discovered a buffer overflow when parsing     SIMPLE headers.

  - CVE-2014-0020     Daniel Atallah discovered that Pidgin could be crashed     via malformed IRC arguments.

Yves Younan and Ryan Pentney discovered that libgadu incorrectly handled certain Gadu-Gadu HTTP messages. A malicious remote server or a man in the middle could use this issue to cause applications using libgadu to crash, resulting in a denial of service, or possibly execute arbitrary code.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Thijs Alkemade and Robert Vehse discovered that Pidgin incorrectly handled the Yahoo! protocol. A remote attacker could use this issue to cause Pidgin to crash, resulting in a denial of service.
(CVE-2012-6152)

Jaime Breva Ribes discovered that Pidgin incorrectly handled the XMPP protocol. A remote attacker could use this issue to cause Pidgin to crash, resulting in a denial of service. (CVE-2013-6477)

It was discovered that Pidgin incorrecly handled long URLs. A remote attacker could use this issue to cause Pidgin to crash, resulting in a denial of service. (CVE-2013-6478)

Jacob Appelbaum discovered that Pidgin incorrectly handled certain HTTP responses. A malicious remote server or a man in the middle could use this issue to cause Pidgin to crash, resulting in a denial of service. (CVE-2013-6479)

Daniel Atallah discovered that Pidgin incorrectly handled the Yahoo! protocol. A remote attacker could use this issue to cause Pidgin to crash, resulting in a denial of service. (CVE-2013-6481)

Fabian Yamaguchi and Christian Wressnegger discovered that Pidgin incorrectly handled the MSN protocol. A remote attacker could use this issue to cause Pidgin to crash, resulting in a denial of service.
(CVE-2013-6482)

Fabian Yamaguchi and Christian Wressnegger discovered that Pidgin incorrectly handled XMPP iq replies. A remote attacker could use this issue to spoof messages. (CVE-2013-6483)

It was discovered that Pidgin incorrectly handled STUN server responses. A remote attacker could use this issue to cause Pidgin to crash, resulting in a denial of service. (CVE-2013-6484)

Matt Jones discovered that Pidgin incorrectly handled certain chunked HTTP responses. A malicious remote server or a man in the middle could use this issue to cause Pidgin to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2013-6485)

Yves Younan and Ryan Pentney discovered that Pidgin incorrectly handled certain Gadu-Gadu HTTP messages. A malicious remote server or a man in the middle could use this issue to cause Pidgin to crash, resulting in a denial of service, or possibly execute arbitrary code.
(CVE-2013-6487)

Yves Younan and Pawel Janic discovered that Pidgin incorrectly handled MXit emoticons. A remote attacker could use this issue to cause Pidgin to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2013-6489)

Yves Younan discovered that Pidgin incorrectly handled SIMPLE headers.
A remote attacker could use this issue to cause Pidgin to crash, resulting in a denial of service, or possibly execute arbitrary code.
(CVE-2013-6490)

Daniel Atallah discovered that Pidgin incorrectly handled IRC argument parsing. A malicious remote server or a man in the middle could use this issue to cause Pidgin to crash, resulting in a denial of service.
(CVE-2014-0020).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Yves Younan and Ryan Pentney discovered that libgadu, a library for accessing the Gadu-Gadu instant messaging service, contained an integer overflow leading to a buffer overflow. Attackers which impersonate the server could crash clients and potentially execute arbitrary code.

A heap-based buffer overflow flaw was found in the way Pidgin processed certain HTTP responses. A malicious server could send a specially crafted HTTP response, causing Pidgin to crash or potentially execute arbitrary code with the permissions of the user running Pidgin. (CVE-2013-6485)

Multiple heap-based buffer overflow flaws were found in several protocol plug-ins in Pidgin (Gadu-Gadu, MXit, SIMPLE). A malicious server could send a specially crafted message, causing Pidgin to crash or potentially execute arbitrary code with the permissions of the user running Pidgin. (CVE-2013-6487, CVE-2013-6489, CVE-2013-6490)

Multiple denial of service flaws were found in several protocol plug-ins in Pidgin (Yahoo!, XMPP, MSN, stun, IRC). A remote attacker could use these flaws to crash Pidgin by sending a specially crafted message. (CVE-2012-6152, CVE-2013-6477, CVE-2013-6481, CVE-2013-6482, CVE-2013-6484, CVE-2014-0020)

It was found that the Pidgin XMPP protocol plug-in did not verify the origin of 'iq' replies. A remote attacker could use this flaw to spoof an 'iq' reply, which could lead to injection of fake data or cause Pidgin to crash via a NULL pointer dereference. (CVE-2013-6483)

A flaw was found in the way Pidgin parsed certain HTTP response headers. A remote attacker could use this flaw to crash Pidgin via a specially crafted HTTP response header. (CVE-2013-6479)

It was found that Pidgin crashed when a mouse pointer was hovered over a long URL. A remote attacker could use this flaw to crash Pidgin by sending a message containing a long URL string. (CVE-2013-6478)

Pidgin must be restarted for this update to take effect.

Updated pidgin packages that fix multiple security issues are now available for Red Hat Enterprise Linux 5 and 6.

The Red Hat Security Response Team has rated this update as having moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

Pidgin is an instant messaging program which can log in to multiple accounts on multiple instant messaging networks simultaneously.

A heap-based buffer overflow flaw was found in the way Pidgin processed certain HTTP responses. A malicious server could send a specially crafted HTTP response, causing Pidgin to crash or potentially execute arbitrary code with the permissions of the user running Pidgin. (CVE-2013-6485)

Multiple heap-based buffer overflow flaws were found in several protocol plug-ins in Pidgin (Gadu-Gadu, MXit, SIMPLE). A malicious server could send a specially crafted message, causing Pidgin to crash or potentially execute arbitrary code with the permissions of the user running Pidgin. (CVE-2013-6487, CVE-2013-6489, CVE-2013-6490)

Multiple denial of service flaws were found in several protocol plug-ins in Pidgin (Yahoo!, XMPP, MSN, stun, IRC). A remote attacker could use these flaws to crash Pidgin by sending a specially crafted message. (CVE-2012-6152, CVE-2013-6477, CVE-2013-6481, CVE-2013-6482, CVE-2013-6484, CVE-2014-0020)

It was found that the Pidgin XMPP protocol plug-in did not verify the origin of 'iq' replies. A remote attacker could use this flaw to spoof an 'iq' reply, which could lead to injection of fake data or cause Pidgin to crash via a NULL pointer dereference. (CVE-2013-6483)

A flaw was found in the way Pidgin parsed certain HTTP response headers. A remote attacker could use this flaw to crash Pidgin via a specially crafted HTTP response header. (CVE-2013-6479)

It was found that Pidgin crashed when a mouse pointer was hovered over a long URL. A remote attacker could use this flaw to crash Pidgin by sending a message containing a long URL string. (CVE-2013-6478)

Red Hat would like to thank the Pidgin project for reporting these issues. Upstream acknowledges Thijs Alkemade, Robert Vehse, Jaime Breva Ribes, Jacob Appelbaum of the Tor Project, Daniel Atallah, Fabian Yamaguchi and Christian Wressnegger of the University of Goettingen, Matt Jones of Volvent, and Yves Younan, Ryan Pentney, and Pawel Janic of Sourcefire VRT as the original reporters of these issues.

All pidgin users are advised to upgrade to these updated packages, which contain backported patches to correct these issues. Pidgin must be restarted for this update to take effect.

From Red Hat Security Advisory 2014:0139 :

Updated pidgin packages that fix multiple security issues are now available for Red Hat Enterprise Linux 5 and 6.

The Red Hat Security Response Team has rated this update as having moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

Pidgin is an instant messaging program which can log in to multiple accounts on multiple instant messaging networks simultaneously.

A heap-based buffer overflow flaw was found in the way Pidgin processed certain HTTP responses. A malicious server could send a specially crafted HTTP response, causing Pidgin to crash or potentially execute arbitrary code with the permissions of the user running Pidgin. (CVE-2013-6485)

Multiple heap-based buffer overflow flaws were found in several protocol plug-ins in Pidgin (Gadu-Gadu, MXit, SIMPLE). A malicious server could send a specially crafted message, causing Pidgin to crash or potentially execute arbitrary code with the permissions of the user running Pidgin. (CVE-2013-6487, CVE-2013-6489, CVE-2013-6490)

Multiple denial of service flaws were found in several protocol plug-ins in Pidgin (Yahoo!, XMPP, MSN, stun, IRC). A remote attacker could use these flaws to crash Pidgin by sending a specially crafted message. (CVE-2012-6152, CVE-2013-6477, CVE-2013-6481, CVE-2013-6482, CVE-2013-6484, CVE-2014-0020)

It was found that the Pidgin XMPP protocol plug-in did not verify the origin of 'iq' replies. A remote attacker could use this flaw to spoof an 'iq' reply, which could lead to injection of fake data or cause Pidgin to crash via a NULL pointer dereference. (CVE-2013-6483)

A flaw was found in the way Pidgin parsed certain HTTP response headers. A remote attacker could use this flaw to crash Pidgin via a specially crafted HTTP response header. (CVE-2013-6479)

It was found that Pidgin crashed when a mouse pointer was hovered over a long URL. A remote attacker could use this flaw to crash Pidgin by sending a message containing a long URL string. (CVE-2013-6478)

Red Hat would like to thank the Pidgin project for reporting these issues. Upstream acknowledges Thijs Alkemade, Robert Vehse, Jaime Breva Ribes, Jacob Appelbaum of the Tor Project, Daniel Atallah, Fabian Yamaguchi and Christian Wressnegger of the University of Goettingen, Matt Jones of Volvent, and Yves Younan, Ryan Pentney, and Pawel Janic of Sourcefire VRT as the original reporters of these issues.

All pidgin users are advised to upgrade to these updated packages, which contain backported patches to correct these issues. Pidgin must be restarted for this update to take effect.

The version of Pidgin installed on the remote host is a version prior to 2.10.8. It is, therefore, potentially affected by the following vulnerabilities :

  - The bundled version of Pango has an error that can lead     to an application crash when rendering fonts and     attempting to display certain Unicode characters. 

  - Errors exist related to handling unspecified     characters, incorrect character encoding, incorrect     XMPP timestamps, hovering a pointer over a long URL,     unspecified HTTP responses, Yahoo! P2P messages, STUN     responses, and IRC arguments that could cause     application crashes and denial of service conditions.
    (CVE-2012-6152, CVE-2013-6477, CVE-2013-6478,     CVE-2013-6479, CVE-2013-6481, CVE-2013-6484,     CVE-2014-0020)

  - Errors exist related to handling MSN SOAP, MSN OIM, and     MSN header content that could cause application     crashes when NULL pointers are dereferenced.
    (CVE-2013-6482)

  - An error exists related XMPP content such that the     'from' portion of some 'iq' replies is not verified.
    (CVE-2013-6483)

  - Errors exist related to parsing chunked and     Gadu-Gadu HTTP content, MXit emoticons, and     SIMPLE headers that could allow buffer overflows.
    (CVE-2013-6485, CVE-2013-6487, CVE-2013-6489,     CVE-2013-6490)

  - The application does not protect against links to     untrusted executable content. (CVE-2013-6486)

New pidgin packages are available for Slackware 13.0, 13.1, 13.37, 14.0, 14.1, and -current to fix security issues.

ID	Name	Product	Family	Severity
85430	GLSA-201508-02 : libgadu: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
80740	Oracle Solaris Third-Party Patch Update : pidgin (multiple_vulnerabilities_in_pidgin2)	Nessus	Solaris Local Security Checks	critical
75378	openSUSE Security Update : libgadu (openSUSE-SU-2014:0722-1)	Nessus	SuSE Local Security Checks	high
75256	openSUSE Security Update : pidgin / pidgin-branding-openSUSE (openSUSE-SU-2014:0239-1)	Nessus	SuSE Local Security Checks	high
74506	SuSE 11.3 Security Update : libgadu (SAT Patch Number 9277)	Nessus	SuSE Local Security Checks	high
74173	SuSE 11.3 Security Update : finch (SAT Patch Number 9213)	Nessus	SuSE Local Security Checks	critical
74064	GLSA-201405-22 : Pidgin: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	critical
72649	Fedora 19 : libgadu-1.12.0-0.3.rc2.fc19 (2014-2341)	Nessus	Fedora Local Security Checks	high
72563	Mandriva Linux Security Advisory : libgadu (MDVSA-2014:039)	Nessus	Mandriva Local Security Checks	high
72522	Fedora 20 : libgadu-1.12.0-0.3.rc2.fc20 (2014-2391)	Nessus	Fedora Local Security Checks	high
72519	Fedora 19 : pidgin-2.10.9-1.fc19 (2014-1999)	Nessus	Fedora Local Security Checks	critical
72439	Debian DSA-2859-1 : pidgin - several vulnerabilities	Nessus	Debian Local Security Checks	critical
72424	Ubuntu 12.04 LTS / 12.10 / 13.10 : libgadu vulnerability (USN-2101-1)	Nessus	Ubuntu Local Security Checks	high
72386	Ubuntu 12.04 LTS / 12.10 / 13.10 : pidgin vulnerabilities (USN-2100-1)	Nessus	Ubuntu Local Security Checks	critical
72375	Debian DSA-2852-1 : libgadu - heap-based buffer overflow	Nessus	Debian Local Security Checks	high
72365	Scientific Linux Security Update : pidgin on SL5.x, SL6.x i386/x86_64 (20140205)	Nessus	Scientific Linux Local Security Checks	critical
72364	RHEL 5 / 6 : pidgin (RHSA-2014:0139)	Nessus	Red Hat Local Security Checks	critical
72362	Oracle Linux 6 : pidgin (ELSA-2014-0139)	Nessus	Oracle Linux Local Security Checks	critical
72359	Fedora 20 : pidgin-2.10.9-1.fc20 (2014-2013)	Nessus	Fedora Local Security Checks	critical
72352	CentOS 5 / 6 : pidgin (CESA-2014:0139)	Nessus	CentOS Local Security Checks	critical
72282	Pidgin < 2.10.8 Multiple Vulnerabilities	Nessus	Windows	critical
72265	Slackware 13.0 / 13.1 / 13.37 / 14.0 / 14.1 / current : pidgin (SSA:2014-034-01)	Nessus	Slackware Local Security Checks	critical

Detections

Analytics

CVE-2013-6487

critical

Tenable Plugins

high

critical

high

high

high

critical

critical

high

high

high

critical

critical

high

critical

high

critical

critical

critical

critical

critical

critical

critical