==========================================================================
Ubuntu Security Notice USN-2216-1
May 21, 2014

pidgin vulnerability
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

– Ubuntu 14.04 LTS
– Ubuntu 13.10
– Ubuntu 12.04 LTS

Summary:

Pidgin could be made to crash or run programs if it received specially
crafted network traffic.

Software Description:
– pidgin: graphical multi-protocol instant messaging client for X

Details:

It was discovered that Pidgin incorrectly handled certain messages from
Gadu-Gadu file relay servers. A malicious remote server or a man in the
middle could use this issue to cause Pidgin to crash, resulting in a denial
of service, or possibly execute arbitrary code.

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 14.04 LTS:
libpurple0 1:2.10.9-0ubuntu3.1
pidgin 1:2.10.9-0ubuntu3.1

Ubuntu 13.10:
libpurple0 1:2.10.7-0ubuntu4.1.13.10.2
pidgin 1:2.10.7-0ubuntu4.1.13.10.2

Ubuntu 12.04 LTS:
libpurple0 1:2.10.3-0ubuntu1.5
pidgin 1:2.10.3-0ubuntu1.5

After a standard system update you need to restart Pidgin to make all the
necessary changes.

References:
http://www.ubuntu.com/usn/usn-2216-1
CVE-2014-3775

Package Information:
https://launchpad.net/ubuntu/+source/pidgin/1:2.10.9-0ubuntu3.1
https://launchpad.net/ubuntu/+source/pidgin/1:2.10.7-0ubuntu4.1.13.10.2
https://launchpad.net/ubuntu/+source/pidgin/1:2.10.3-0ubuntu1.5

—–BEGIN PGP SIGNATURE—–
Version: GnuPG v1
Comment: Using GnuPG with Thunderbird – http://www.enigmail.net/

iQIcBAEBCgAGBQJTfJ9wAAoJEGVp2FWnRL6TmP0P/2Pj8+22rv/OUzBnhBtD9RU7
km+AmAUYIHLXXTyybNLUzEN3GKWhx98IPD2LYUCgdrp7rytFUyt1SpFLx0r8rOHl
npcgjJpjloTzACiA0am/CuZn8ZRo7uD09r/JqaE9UcWZwbw4pN3HH5zAkiP8EsAE
LPK+Cna9QHlX8Q39RkI2lwGHE3RJvW3QQJSym2OeQSCCqrHp3/+LOnylmpGpnPjE
tmicRi8oixW9bVJ+FDrBzyxCwpKJB5POgkgmdc7M0By8LxpcQ8tP4GI64IzFWMQu
fiNb1kZmnyQtiywt0/b0A+4V0rBaW08/yA+GQeDckt+LTOXLTPhUDnse3cvxXqH+
Kxc/HKmeCDl7f96Ucap0Bi17DWsnJHF7YUz7jQY7VR8KZCzZFphdvJ5E9rgJRuzH
EFHXrerWdtK7Hl0TlCgVf+emacSE3y2fCxhHWNK6jk3B5XaquB7lnzy+aGDy8L8K
CM3uamyjANjme1nIi/97LDYk0xiaMGm/0WsvpHn23kX0NNKbdQaUQIwGSDEYEXQD
V9Nn31G+8SWSiqE0Is9uSYre/XGAYCiTElre+PtfPH7WUnJD1ySEjhVdZbPtIoPj
7Y+xrOYyE1q2eUuUsWqxHsqwPTNWjnUMB+QnlbKmbMlyKmI408OrCzQ9tZDaCd/X
ZQOmTCQ3oSe7jcCo1LsB
=tTgy
—–END PGP SIGNATURE—–
—