Message-Id: <20100517203756.A7A3D3268BB@morgana.loeki.tv>
Date: Mon, 17 May 2010 22:37:56 +0200 (CEST)
From: Thijs Kinkhorst <thijs@...ian.org>
To: bugtraq@...urityfocus.com
Subject: [SECURITY] [DSA 2038-2] New pidgin packages fix regression

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

- ------------------------------------------------------------------------
Debian Security Advisory DSA-2038-2                  security@...ian.org
http://www.debian.org/security/                          Thijs Kinkhorst
May 17, 2010                          http://www.debian.org/security/faq
- ------------------------------------------------------------------------

Package        : pidgin
Vulnerability  : several
Problem type   : remote
Debian-specific: no
CVE Id(s)      : CVE-2010-0420 CVE-2010-0423
Debian Bug     : 566775 579601

The packages for Pidgin released as DSA 2038-1 had a regression, as they
unintentionally disabled the Zephyr instant messaging protocol. This
update restores Zephyr functionality. For reference the original
advisory text below.

Several remote vulnerabilities have been discovered in Pidgin, a multi
protocol instant messaging client. The Common Vulnerabilities and
Exposures project identifies the following problems:

CVE-2010-0420

        Crafted nicknames in the XMPP protocol can crash Pidgin remotely.

CVE-2010-0423

        Remote contacts may send too many custom smilies, crashing Pidgin.

Since a few months, Microsoft's servers for MSN have changed the protocol,
making Pidgin non-functional for use with MSN. It is not feasible to port
these changes to the version of Pidgin in Debian Lenny. This update
formalises that situation by disabling the protocol in the client. Users
of the MSN protocol are advised to use the version of Pidgin in the
repositories of www.backports.org.

For the stable distribution (lenny), these problems have been fixed in
version 2.4.3-4lenny7.

For the unstable distribution (sid), these problems have been fixed in
version 2.6.6-1.

We recommend that you upgrade your pidgin package.

Upgrade instructions
- --------------------

wget url
        will fetch the file for you
dpkg -i file.deb
        will install the referenced file.

If you are using the apt-get package manager, use the line for
sources.list as given below:

apt-get update
        will update the internal database
apt-get upgrade
        will install corrected packages

You may use an automated update by adding the resources from the
footer to the proper configuration.

Debian GNU/Linux 5.0 alias lenny
- --------------------------------

Source archives:

  http://security.debian.org/pool/updates/main/p/pidgin/pidgin_2.4.3.orig.tar.gz
    Size/MD5 checksum: 13123610 d0e0bd218fbc67df8b2eca2f21fcd427
  http://security.debian.org/pool/updates/main/p/pidgin/pidgin_2.4.3-4lenny7.diff.gz
    Size/MD5 checksum:    72195 fe0a9dd9d55d642dc77c4f7c678522c8
  http://security.debian.org/pool/updates/main/p/pidgin/pidgin_2.4.3-4lenny7.dsc
    Size/MD5 checksum:     1784 300f72738867fcd326db7f836ac47d67

Architecture independent packages:

  http://security.debian.org/pool/updates/main/p/pidgin/pidgin-data_2.4.3-4lenny7_all.deb
    Size/MD5 checksum:  7019174 3d1e4508e5543441a5d04a31f03b0979
  http://security.debian.org/pool/updates/main/p/pidgin/pidgin-dev_2.4.3-4lenny7_all.deb
    Size/MD5 checksum:   193842 b2c75fc6891adad16add69903ce9762d
  http://security.debian.org/pool/updates/main/p/pidgin/finch-dev_2.4.3-4lenny7_all.deb
    Size/MD5 checksum:   159766 5bb66c4efe6c67eeb33297738799a831
  http://security.debian.org/pool/updates/main/p/pidgin/libpurple-bin_2.4.3-4lenny7_all.deb
    Size/MD5 checksum:   133930 c25806d1d9a07c49c5a3b2fd0b83964c
  http://security.debian.org/pool/updates/main/p/pidgin/libpurple-dev_2.4.3-4lenny7_all.deb
    Size/MD5 checksum:   277224 c169cf3a82bb6a0faf1d285a7377b695

alpha architecture (DEC Alpha)

  http://security.debian.org/pool/updates/main/p/pidgin/libpurple0_2.4.3-4lenny7_alpha.deb
    Size/MD5 checksum:  1501864 9aa23188e1610834d035e88fd30308b8
  http://security.debian.org/pool/updates/main/p/pidgin/finch_2.4.3-4lenny7_alpha.deb
    Size/MD5 checksum:   369772 a8eb912226cf47f5f74892f0b1110cc4
  http://security.debian.org/pool/updates/main/p/pidgin/pidgin_2.4.3-4lenny7_alpha.deb
    Size/MD5 checksum:   776646 bf0f80658559ab3e4c22356dd47d809d
  http://security.debian.org/pool/updates/main/p/pidgin/pidgin-dbg_2.4.3-4lenny7_alpha.deb
    Size/MD5 checksum:  4989752 30e054746fff6d56a9e3b288039ff6c9

amd64 architecture (AMD x86_64 (AMD64))

  http://security.debian.org/pool/updates/main/p/pidgin/pidgin_2.4.3-4lenny7_amd64.deb
    Size/MD5 checksum:   727950 57554918978a95ea250a8494c9aab433
  http://security.debian.org/pool/updates/main/p/pidgin/libpurple0_2.4.3-4lenny7_amd64.deb
    Size/MD5 checksum:  1429960 2779007da91fe74a1304f3263cd7d53e
  http://security.debian.org/pool/updates/main/p/pidgin/finch_2.4.3-4lenny7_amd64.deb
    Size/MD5 checksum:   348100 d01043df40ed1861c63043b44289984d
  http://security.debian.org/pool/updates/main/p/pidgin/pidgin-dbg_2.4.3-4lenny7_amd64.deb
    Size/MD5 checksum:  5101892 af2ea1456eb390f3930e6164108a9c7f

arm architecture (ARM)

  http://security.debian.org/pool/updates/main/p/pidgin/finch_2.4.3-4lenny7_arm.deb
    Size/MD5 checksum:   316624 290e5d8fa14bcc09dde3ce6d326d84bd
  http://security.debian.org/pool/updates/main/p/pidgin/pidgin_2.4.3-4lenny7_arm.deb
    Size/MD5 checksum:   657416 1997d30109a1c86c6c8979ff2e0511ee
  http://security.debian.org/pool/updates/main/p/pidgin/pidgin-dbg_2.4.3-4lenny7_arm.deb
    Size/MD5 checksum:  4835872 9f2aaef6679c3b2e27a73240799a7ffa
  http://security.debian.org/pool/updates/main/p/pidgin/libpurple0_2.4.3-4lenny7_arm.deb
    Size/MD5 checksum:  1239516 640fd3ff6c91ac45820581df86965af8

armel architecture (ARM EABI)

  http://security.debian.org/pool/updates/main/p/pidgin/pidgin_2.4.3-4lenny7_armel.deb
    Size/MD5 checksum:   668000 b0bc286a8e2d74a033ac69b5ed234e6e
  http://security.debian.org/pool/updates/main/p/pidgin/libpurple0_2.4.3-4lenny7_armel.deb
    Size/MD5 checksum:  1243880 88c529b8e9178969c3a3a13e1a8e3230
  http://security.debian.org/pool/updates/main/p/pidgin/finch_2.4.3-4lenny7_armel.deb
    Size/MD5 checksum:   319962 72d956d2c3b6b04dc0aed07e6d99e944
  http://security.debian.org/pool/updates/main/p/pidgin/pidgin-dbg_2.4.3-4lenny7_armel.deb
    Size/MD5 checksum:  4851712 6134571c92b5495489555c01fc4a6d51

hppa architecture (HP PA RISC)

  http://security.debian.org/pool/updates/main/p/pidgin/libpurple0_2.4.3-4lenny7_hppa.deb
    Size/MD5 checksum:  1522820 023def8c7a3051e1d15030347c99e99d
  http://security.debian.org/pool/updates/main/p/pidgin/pidgin_2.4.3-4lenny7_hppa.deb
    Size/MD5 checksum:   752858 43129b10ef60136293b349614a662972
  http://security.debian.org/pool/updates/main/p/pidgin/pidgin-dbg_2.4.3-4lenny7_hppa.deb
    Size/MD5 checksum:  4943738 9cc7aee5d06445b07cceb81efa3ba30d
  http://security.debian.org/pool/updates/main/p/pidgin/finch_2.4.3-4lenny7_hppa.deb
    Size/MD5 checksum:   360748 353f5caf6903c89a3bdd482dd6a520e6

i386 architecture (Intel ia32)

  http://security.debian.org/pool/updates/main/p/pidgin/pidgin_2.4.3-4lenny7_i386.deb
    Size/MD5 checksum:   681390 82c10195fb937a47a113940fa93dbdb5
  http://security.debian.org/pool/updates/main/p/pidgin/pidgin-dbg_2.4.3-4lenny7_i386.deb
    Size/MD5 checksum:  4837960 416ddcf7b18e7b2a474fa56731a93f7b
  http://security.debian.org/pool/updates/main/p/pidgin/finch_2.4.3-4lenny7_i386.deb
    Size/MD5 checksum:   326994 06bb2fefdc9ea9dce38a5481f33dcdf5
  http://security.debian.org/pool/updates/main/p/pidgin/libpurple0_2.4.3-4lenny7_i386.deb
    Size/MD5 checksum:  1317496 9218b0b46b8716781d80133e77194170

ia64 architecture (Intel ia64)

  http://security.debian.org/pool/updates/main/p/pidgin/libpurple0_2.4.3-4lenny7_ia64.deb
    Size/MD5 checksum:  1821990 87c03b5c08d97b8c8ae2a573ecd3cecb
  http://security.debian.org/pool/updates/main/p/pidgin/finch_2.4.3-4lenny7_ia64.deb
    Size/MD5 checksum:   435010 22dee93a1714c2654ec0dfaa8705cfe2
  http://security.debian.org/pool/updates/main/p/pidgin/pidgin-dbg_2.4.3-4lenny7_ia64.deb
    Size/MD5 checksum:  4706272 6e0b0c3291dceb229522e1de229e3361
  http://security.debian.org/pool/updates/main/p/pidgin/pidgin_2.4.3-4lenny7_ia64.deb
    Size/MD5 checksum:   948766 ddf4cff0ac25735e5d18edcbeb970bf4

mips architecture (MIPS (Big Endian))

  http://security.debian.org/pool/updates/main/p/pidgin/libpurple0_2.4.3-4lenny7_mips.deb
    Size/MD5 checksum:  1117676 eb4a88cc934233faafebdcebc1171bc3
  http://security.debian.org/pool/updates/main/p/pidgin/finch_2.4.3-4lenny7_mips.deb
    Size/MD5 checksum:   319576 4ad4d7a878a0d5daaff189da549c4638
  http://security.debian.org/pool/updates/main/p/pidgin/pidgin-dbg_2.4.3-4lenny7_mips.deb
    Size/MD5 checksum:  5087780 9ebfc36f1749b61ab7a4fe70d0770f88
  http://security.debian.org/pool/updates/main/p/pidgin/pidgin_2.4.3-4lenny7_mips.deb
    Size/MD5 checksum:   654936 d63bd6a67138596ef85b7a3259fceee7

mipsel architecture (MIPS (Little Endian))

  http://security.debian.org/pool/updates/main/p/pidgin/pidgin-dbg_2.4.3-4lenny7_mipsel.deb
    Size/MD5 checksum:  4999390 ad6121a42731cb360d76b6fe67180924
  http://security.debian.org/pool/updates/main/p/pidgin/finch_2.4.3-4lenny7_mipsel.deb
    Size/MD5 checksum:   318598 8b0b8f40209b828098f6ed000c517f65
  http://security.debian.org/pool/updates/main/p/pidgin/libpurple0_2.4.3-4lenny7_mipsel.deb
    Size/MD5 checksum:  1108760 4e9f79966b7fa0df677a1a5952488e62
  http://security.debian.org/pool/updates/main/p/pidgin/pidgin_2.4.3-4lenny7_mipsel.deb
    Size/MD5 checksum:   651474 7b24d4210caaf4d27b9b3863393bffd6

powerpc architecture (PowerPC)

  http://security.debian.org/pool/updates/main/p/pidgin/libpurple0_2.4.3-4lenny7_powerpc.deb
    Size/MD5 checksum:  1470622 c51b3531cc31005e58feac25f8606bd3
  http://security.debian.org/pool/updates/main/p/pidgin/pidgin-dbg_2.4.3-4lenny7_powerpc.deb
    Size/MD5 checksum:  5052846 986c8a8ac0ccd3399393bceda957656f
  http://security.debian.org/pool/updates/main/p/pidgin/finch_2.4.3-4lenny7_powerpc.deb
    Size/MD5 checksum:   362770 f00c1a33b3598333dfc4ae9d61bf1d83
  http://security.debian.org/pool/updates/main/p/pidgin/pidgin_2.4.3-4lenny7_powerpc.deb
    Size/MD5 checksum:   755104 ae81b0387a32b162fb30ac425dc4ad43

s390 architecture (IBM S/390)

  http://security.debian.org/pool/updates/main/p/pidgin/pidgin-dbg_2.4.3-4lenny7_s390.deb
    Size/MD5 checksum:  5014182 c093e4c7e6e3b6132a8145a35e88c3fb
  http://security.debian.org/pool/updates/main/p/pidgin/finch_2.4.3-4lenny7_s390.deb
    Size/MD5 checksum:   359260 919eb5ad29cb280d84ef36b2c45273b9
  http://security.debian.org/pool/updates/main/p/pidgin/libpurple0_2.4.3-4lenny7_s390.deb
    Size/MD5 checksum:  1351418 a94314c09692e3a9350b8bd1684843bc
  http://security.debian.org/pool/updates/main/p/pidgin/pidgin_2.4.3-4lenny7_s390.deb
    Size/MD5 checksum:   718026 52121ab6cf237545c29f10826b98894b

sparc architecture (Sun SPARC/UltraSPARC)

  http://security.debian.org/pool/updates/main/p/pidgin/pidgin-dbg_2.4.3-4lenny7_sparc.deb
    Size/MD5 checksum:  4639296 f38822c989d40d124d82abc53ae42d38
  http://security.debian.org/pool/updates/main/p/pidgin/finch_2.4.3-4lenny7_sparc.deb
    Size/MD5 checksum:   328662 f5fe4eb9c81b2aa8d335b983288902dd
  http://security.debian.org/pool/updates/main/p/pidgin/pidgin_2.4.3-4lenny7_sparc.deb
    Size/MD5 checksum:   683246 d37d198e8bb1d5c3f98521dcc0a43c24
  http://security.debian.org/pool/updates/main/p/pidgin/libpurple0_2.4.3-4lenny7_sparc.deb
    Size/MD5 checksum:  1323820 54026420c5be2e153e7a8ffbcb70b5cd


  These files will probably be moved into the stable distribution on
  its next update.

- ---------------------------------------------------------------------------------
For apt-get: deb http://security.debian.org/ stable/updates main
For dpkg-ftp: ftp://security.debian.org/debian-security dists/stable/updates/main
Mailing list: debian-security-announce@...ts.debian.org
Package info: `apt-cache show <pkg>' and http://packages.debian.org/<pkg>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.10 (GNU/Linux)

iQEcBAEBAgAGBQJL8ajrAAoJECIIoQCMVaAcxI0H/0Q4UHvj1XAmzt11lTuRsPrg
MtGbmdL0lXfCgMkgE6XPWRYQbS19ZI8gGXsRDp/vtFpNRY6bvyihmWtmaujvoh5/
dTS9DwdU+/jEDeaNzQh8nzUllJUwOa7TgjbtraBKMSGnZQIB8fhoiTtfn4ZN3NLs
4f6qucNc0YMgLpZ1uyGVzNJUzz0SzwfsVtkrQGlL3TNNZ/+8PwgTS/Yo+fxB7cc8
9DvZ7ARcThuL2vjIQsNZear0uwABrfjD0TpdHERHyWY2qBd+H0A1MGjpMoXlh0hF
5vopr4oHRRtKflaCoUWJeHRcwHa5gGO/XW7DdHTgk0OlIAiFFC7bEo1A6JInr04=
=ZQl4
-----END PGP SIGNATURE-----

Powered by blists - more mailing lists