pidgin.yaml 74.9 KB
Newer Older
Etalab's avatar
Etalab committed
1 2 3 4
name: pidgin
canonical:
  canonicalName:
    value: Pidgin Internet Messenger
5
    source: debian_appstream
Etalab's avatar
Etalab committed
6 7 8
  longDescription:
    fr:
      value: " Pidgin est un client de messagerie graphique et modulaire, capable\n d'utiliser plusieurs réseaux à la fois. Il prend actuellement en charge\n AIM/ICQ,\n Yahoo!, MSN, IRC, Jabber/XMPP/Google Talk, Napster, Zephyr, Gadu-Gadu,\n Bonjour, Groupwise, Sametime, SIMPLE, MySpaceIM, et MXit.\n .\n Certains paquets supplémentaires sont suggérés pour des fonctionnalités\n supplémentaires:\n  * libsqlite3-0:\n    - Pour utilliser le greffon de prédiction de disponibilité des contacts\n"
9
      source: debian
Etalab's avatar
Etalab committed
10 11
    en:
      value: " Pidgin is a graphical, modular instant messaging client capable of using\n multiple networks at once. Currently supported are:\n AIM/ICQ, Yahoo!, MSN, IRC, Jabber/XMPP/Google Talk, Napster, Zephyr, Gadu-Gadu,\n Bonjour, Groupwise, Sametime, SIMPLE, MySpaceIM, and MXit.\n .\n Some extra packages are suggested to use increased functionality:\n  * libsqlite3-0:\n    - To use Contact Availability Prediction plugin\n"
12
      source: debian
Etalab's avatar
Etalab committed
13 14
  screenshot:
    value: 'http://screenshots.debian.net/screenshots/p/pidgin/9554_large.png'
15
    source: debian
Emmanuel Raviart's avatar
Emmanuel Raviart committed
16
debian:
17 18 19 20
  _source:
    name: Universal Debian Database
    description_url: 'https://wiki.debian.org/UltimateDebianDatabase'
    url: 'https://git.framasoft.org/codegouv/udd-yaml'
Etalab's avatar
Etalab committed
21
  name: pidgin
Emmanuel Raviart's avatar
Emmanuel Raviart committed
22 23 24
  description:
    da:
      description: grafisk multi-protokol chat-klient til X
Etalab's avatar
Etalab committed
25
      long_description: " Pidgin er en grafisk, modulær chat-klient der er i stand til at bruge flere\n netværk  samme tid. Aktuelt er følgende understøttet:\n AIM/ICQ, Yahoo!, MSN, IRC, Jabber/XMPP/Google Talk, Napster, Zephyr,\n Gadu-Gadu, Bonjour, Groupwise, Sametime, SIMPLE, MySpaceIM og MXit.\n .\n Visse ekstra pakker foreslås for at øge funktionaliteten:\n  * libsqlite3-0:\n    - For at bruge udvidelsesmodulet Contact Availability Prediction\n      (Kontakt Tilgængelighed Forudsigelse)\n"
Emmanuel Raviart's avatar
Emmanuel Raviart committed
26
    de:
Etalab's avatar
Etalab committed
27 28
      description: 'Grafischer Instant-Messaging-Client für X, unterstützt viele Protokolle'
      long_description: " Pidgin ist ein grafischer, modularer Instant-Messaging-Client, der\n mehrere Netzwerke gleichzeitig nutzen kann. Derzeit unterstützt er:\n AIM/ICQ, Yahoo!, MSN, IRC, Jabber/XMPP/Google Talk, Napster, Zephyr,\n Gadu- Gadu, Bonjour, Groupwise, Sametime, SIMPLE, MySpaceIM und MXit.\n .\n Es werden zusätzliche Pakete vorgeschlagen, um erhöhte Funktionalität\n nutzen zu können:\n  * libsqlite3-0:\n    - um das Plugin zur Verfügbarkeitsprüfung von Kontakten verwenden\n      zu können\n"
Emmanuel Raviart's avatar
Emmanuel Raviart committed
29 30
    en:
      description: graphical multi-protocol instant messaging client for X
Etalab's avatar
Etalab committed
31
      long_description: " Pidgin is a graphical, modular instant messaging client capable of using\n multiple networks at once. Currently supported are:\n AIM/ICQ, Yahoo!, MSN, IRC, Jabber/XMPP/Google Talk, Napster, Zephyr, Gadu-Gadu,\n Bonjour, Groupwise, Sametime, SIMPLE, MySpaceIM, and MXit.\n .\n Some extra packages are suggested to use increased functionality:\n  * libsqlite3-0:\n    - To use Contact Availability Prediction plugin\n"
Emmanuel Raviart's avatar
Emmanuel Raviart committed
32 33
    fr:
      description: client graphique multiprotocole de messagerie instantanée pour X
Etalab's avatar
Etalab committed
34
      long_description: " Pidgin est un client de messagerie graphique et modulaire, capable\n d'utiliser plusieurs réseaux à la fois. Il prend actuellement en charge\n AIM/ICQ,\n Yahoo!, MSN, IRC, Jabber/XMPP/Google Talk, Napster, Zephyr, Gadu-Gadu,\n Bonjour, Groupwise, Sametime, SIMPLE, MySpaceIM, et MXit.\n .\n Certains paquets supplémentaires sont suggérés pour des fonctionnalités\n supplémentaires:\n  * libsqlite3-0:\n    - Pour utilliser le greffon de prédiction de disponibilité des contacts\n"
Emmanuel Raviart's avatar
Emmanuel Raviart committed
35 36
    it:
      description: client grafico multiprotocollo per messaggistica istantanea in X
Etalab's avatar
Etalab committed
37
      long_description: " Pidgin è un client grafico modulare di messaggistica istantanea in grado di\n utilizzare contemporaneamente più reti. Quelle attualmente gestite sono:\n AIM/ICQ, Yahoo!, MSN, IRC, Jabber/XMPP/Google Talk, Napster, Zephyr,\n Gadu-Gadu, Bonjour, Groupwise, Sametime, SIMPLE, MySpaceIM e MXit.\n .\n Per usare funzionalità ulteriori sono suggeriti altri pacchetti extra:\n   * libsqlite3-0:\n     - per usare il plugin Contact Availability Prediction\n"
Emmanuel Raviart's avatar
Emmanuel Raviart committed
38
    pl:
Etalab's avatar
Etalab committed
39 40
      description: 'Graficzny, wieloprotokołowy komunikator internetowy do systemu X Window'
      long_description: " Pidgin jest graficznym, modułowym komunikatorem potrafiącym pracować z\n wieloma sieciami jednocześnie. Obecnie obsługiwane są:\n AIM/ICQ, Yahoo!, MSN, IRC, Jabber/XMPP/Google Talk, Napster, Zephyr,\n Gadu-Gadu, Bonjour, Groupwise, Sametime, SIMPLE, MySpaceIM i MXit.\n .\n Dodatkowe pakiety sugerowane do zwiększenia funkcjonalności:\n  * libsqlite3-0:\n    - Wtyczka do przewidywania dostępności osób na liście.\n"
Emmanuel Raviart's avatar
Emmanuel Raviart committed
41 42
    pt_BR:
      description: cliente gráfico multiprotocolo de mensagens instantâneas para o X
Etalab's avatar
Etalab committed
43
      long_description: " Pidgin é um cliente gráfico e modular de mensagens instantâneas capaz de\n usar múltiplas redes ao mesmo tempo. As redes para as quais atualmente \n suporte são: AIM/ICQ, Yahoo!, MSN, IRC, Jabber/XMPP/Google Talk, Napster,\n Zephyr, Gadu-Gadu, Bonjour, Groupwise, Sametime, SIMPLE, MySpaceIM, e MXit.\n .\n São sugeridos alguns pacotes extras para aumentar suas funcionalidades:\n  * libsqlite3-0:\n    - Para usar a extensão de Predição Disponibilidade de Contato (\"Contact\n Availability Prediction\").\n"
Emmanuel Raviart's avatar
Emmanuel Raviart committed
44 45
    ru:
      description: графический мультипротокольный клиент служб мгновенного обмена сообщениями
Etalab's avatar
Etalab committed
46
      long_description: " Pidgin  модульный графический клиент обмена мгновенными сообщениями,\n способный использовать несколько протоколов одновременно. В настоящее время\n поддерживаются: AIM/ICQ, Yahoo!, MSN, IRC, Jabber/XMPP/Google Talk, Napster,\n Zephyr, Gadu-Gadu, Bonjour, Groupwise, Sametime, SIMPLE, MySpaceIM и MXit.\n .\n Для увеличения функциональности рекомендуются некоторые дополнительные\n пакеты:\n  * libsqlite3-0:\n    - Для модуля предсказания доступности контакта\n"
Emmanuel Raviart's avatar
Emmanuel Raviart committed
47 48
    sk:
      description: grafický multiprotokolový klient na okamžité posielanie správ pre X
Etalab's avatar
Etalab committed
49
      long_description: " Pidgin je grafický, modulárny klient na okamžité posielanie správ (Instant\n Messaging) schopný používať viacero sietí súčasne. Momentálne \n podporované:\n AIM/ICQ, Yahoo!, MSN, IRC, Jabber/XMPP/Google Talk, Napster, Zephyr, Gadu-\n Gadu, Bonjour, Groupwise, Sametime, SIMPLE, MySpaceIM a MXit.\n .\n Tiež sa navrhuje použitie ďalších balíkov, ktoré rozširujú funkcionalitu:\n  * libsqlite3-0:\n    - na použitie zásuvného modulu predvídania dostupnosti kontaktov\n"
Emmanuel Raviart's avatar
Emmanuel Raviart committed
50 51
    uk:
      description: Графічний клієнт миттєвого спілкування для X з підтримкою багатьох протоколів
Etalab's avatar
Etalab committed
52
      long_description: " Pidgin  графічний, модульний клієнт обміну миттєвими повідомленнями з\n використанням декількох різноманітних мережевих протоколів одночасно.\n На даний момент підтримуються: AIM/ICQ, Yahoo!, MSN, IRC,\n Jabber/XMPP/Google Talk, Napster, Zephyr, Gadu-Gadu, Bonjour, Groupwise,\n Sametime, SIMPLE, MySpaceIM та MXit.\n .\n Деякі додаткові пакунки розширюють функціональність:\n   * „libsqlite3-0“:\n     - для використання втулку прогнозування доступності контакту (Contact\n  Availability Prediction).\n"
Emmanuel Raviart's avatar
Emmanuel Raviart committed
53
  screenshot:
Etalab's avatar
Etalab committed
54 55 56
    large_image_url: 'http://screenshots.debian.net/screenshots/p/pidgin/9554_large.png'
    screenshot_url: 'http://screenshots.debian.net/package/pidgin'
    small_image_url: 'http://screenshots.debian.net/screenshots/p/pidgin/9554_small.png'
57
  security_issues:
Etalab's avatar
Etalab committed
58 59
    CVE-2011-4601:
      description: 'family_feedbag.c in the oscar protocol plugin in libpurple in Pidgin before 2.10.1 does not perform the expected UTF-8 validation on message data, which allows remote attackers to cause a denial of service (application crash) via a crafted (1) AIM or (2) ICQ message associated with buddy-list addition.'
60 61
      releases:
        jessie:
Etalab's avatar
Etalab committed
62
          fixed_version: 2.10.1-1
63
          status: resolved
Etalab's avatar
Etalab committed
64
          urgency: low
65
        sid:
Etalab's avatar
Etalab committed
66
          fixed_version: 2.10.1-1
67
          status: resolved
Etalab's avatar
Etalab committed
68
          urgency: low
69
        squeeze:
Etalab's avatar
Etalab committed
70
          fixed_version: 2.7.3-1+squeeze2
71
          status: resolved
Etalab's avatar
Etalab committed
72
          urgency: 'medium**'
73
        stretch:
Etalab's avatar
Etalab committed
74
          fixed_version: 2.10.1-1
75
          status: resolved
Etalab's avatar
Etalab committed
76
          urgency: low
77
        wheezy:
Etalab's avatar
Etalab committed
78
          fixed_version: 2.10.1-1
79
          status: resolved
Etalab's avatar
Etalab committed
80
          urgency: low
81
      scope: remote
Etalab's avatar
Etalab committed
82 83
    CVE-2007-4996:
      description: "libpurple in Pidgin before 2.2.1 does not properly handle MSN nudge messages from users who are not on the receiver's buddy list, which allows remote attackers to cause a denial of service (crash) via a nudge message that triggers an access of \"an invalid memory location.\""
84 85
      releases:
        jessie:
Etalab's avatar
Etalab committed
86
          fixed_version: 2.2.1-1
87 88 89
          status: resolved
          urgency: medium
        sid:
Etalab's avatar
Etalab committed
90
          fixed_version: 2.2.1-1
91 92 93
          status: resolved
          urgency: medium
        squeeze:
Etalab's avatar
Etalab committed
94
          fixed_version: 2.2.1-1
95 96 97
          status: resolved
          urgency: medium
        stretch:
Etalab's avatar
Etalab committed
98
          fixed_version: 2.2.1-1
99 100 101
          status: resolved
          urgency: medium
        wheezy:
Etalab's avatar
Etalab committed
102
          fixed_version: 2.2.1-1
103 104 105
          status: resolved
          urgency: medium
      scope: remote
106
    CVE-2008-2927:
Etalab's avatar
Etalab committed
107
      description: 'Multiple integer overflows in the msn_slplink_process_msg functions in the MSN protocol handler in (1) libpurple/protocols/msn/slplink.c and (2) libpurple/protocols/msnp9/slplink.c in Pidgin before 2.4.3 and Adium before 1.3 allow remote attackers to execute arbitrary code via a malformed SLP message with a crafted offset value, a different vulnerability than CVE-2008-2955.'
108 109 110 111
      releases:
        jessie:
          fixed_version: 2.4.3-1
          status: resolved
Etalab's avatar
Etalab committed
112
          urgency: 'medium**'
113 114 115
        sid:
          fixed_version: 2.4.3-1
          status: resolved
Etalab's avatar
Etalab committed
116
          urgency: 'medium**'
117 118 119
        squeeze:
          fixed_version: 2.4.3-1
          status: resolved
Etalab's avatar
Etalab committed
120
          urgency: 'medium**'
121 122 123
        stretch:
          fixed_version: 2.4.3-1
          status: resolved
Etalab's avatar
Etalab committed
124
          urgency: 'medium**'
125 126 127
        wheezy:
          fixed_version: 2.4.3-1
          status: resolved
Etalab's avatar
Etalab committed
128
          urgency: 'medium**'
129 130 131
      scope: remote
    CVE-2008-2955:
      bug: 488632
Etalab's avatar
Etalab committed
132
      description: 'Pidgin 2.4.1 allows remote attackers to cause a denial of service (crash) via a long filename that contains certain characters, as demonstrated using an MSN message that triggers the crash in the msn_slplink_process_msg function.'
133 134 135 136 137 138 139 140 141 142 143 144 145 146 147 148 149 150 151 152 153 154 155 156
      releases:
        jessie:
          fixed_version: 2.4.3-1
          status: resolved
          urgency: low
        sid:
          fixed_version: 2.4.3-1
          status: resolved
          urgency: low
        squeeze:
          fixed_version: 2.4.3-1
          status: resolved
          urgency: low
        stretch:
          fixed_version: 2.4.3-1
          status: resolved
          urgency: low
        wheezy:
          fixed_version: 2.4.3-1
          status: resolved
          urgency: low
      scope: remote
    CVE-2008-2956:
      bug: 488632
Etalab's avatar
Etalab committed
157
      description: "** DISPUTED **  Memory leak in Pidgin 2.0.0, and possibly other versions, allows remote attackers to cause a denial of service (memory consumption) via malformed XML documents.   NOTE: this issue has been disputed by the upstream vendor, who states: \"I was never able to identify a scenario under which a problem occurred and the original reporter wasn't able to supply any sort of reproduction details.\""
158 159 160 161 162 163 164 165 166 167 168 169 170 171 172 173 174 175 176
      releases:
        jessie:
          status: open
          urgency: unimportant
        sid:
          status: open
          urgency: unimportant
        squeeze:
          status: open
          urgency: unimportant
        stretch:
          status: open
          urgency: unimportant
        wheezy:
          status: open
          urgency: unimportant
      scope: remote
    CVE-2008-2957:
      bug: 488632
Etalab's avatar
Etalab committed
177
      description: 'The UPnP functionality in Pidgin 2.0.0, and possibly other versions, allows remote attackers to trigger the download of arbitrary files and cause a denial of service (memory or disk consumption) via a UDP packet that specifies an arbitrary URL.'
178 179 180 181 182 183 184 185 186 187 188 189 190 191 192 193 194 195 196 197 198 199 200 201
      releases:
        jessie:
          fixed_version: 2.4.3-4
          status: resolved
          urgency: low
        sid:
          fixed_version: 2.4.3-4
          status: resolved
          urgency: low
        squeeze:
          fixed_version: 2.4.3-4
          status: resolved
          urgency: low
        stretch:
          fixed_version: 2.4.3-4
          status: resolved
          urgency: low
        wheezy:
          fixed_version: 2.4.3-4
          status: resolved
          urgency: low
      scope: remote
    CVE-2008-3532:
      bug: 492434
Etalab's avatar
Etalab committed
202
      description: 'The NSS plugin in libpurple in Pidgin 2.4.3 does not verify SSL certificates, which makes it easier for remote attackers to trick a user into accepting an invalid server certificate for a spoofed service.'
203 204 205 206
      releases:
        jessie:
          fixed_version: 2.4.3-2
          status: resolved
Etalab's avatar
Etalab committed
207
          urgency: 'medium**'
208 209 210
        sid:
          fixed_version: 2.4.3-2
          status: resolved
Etalab's avatar
Etalab committed
211
          urgency: 'medium**'
212 213 214
        squeeze:
          fixed_version: 2.4.3-2
          status: resolved
Etalab's avatar
Etalab committed
215
          urgency: 'medium**'
216 217 218
        stretch:
          fixed_version: 2.4.3-2
          status: resolved
Etalab's avatar
Etalab committed
219
          urgency: 'medium**'
220 221 222
        wheezy:
          fixed_version: 2.4.3-2
          status: resolved
Etalab's avatar
Etalab committed
223
          urgency: 'medium**'
224 225
      scope: remote
    CVE-2009-1373:
Etalab's avatar
Etalab committed
226
      description: 'Buffer overflow in the XMPP SOCKS5 bytestream server in Pidgin (formerly Gaim) before 2.5.6 allows remote authenticated users to execute arbitrary code via vectors involving an outbound XMPP file transfer.  NOTE: some of these details are obtained from third party information.'
227 228 229 230
      releases:
        jessie:
          fixed_version: 2.5.6-1
          status: resolved
Etalab's avatar
Etalab committed
231
          urgency: 'high**'
232 233 234
        sid:
          fixed_version: 2.5.6-1
          status: resolved
Etalab's avatar
Etalab committed
235
          urgency: 'high**'
236 237 238
        squeeze:
          fixed_version: 2.5.6-1
          status: resolved
Etalab's avatar
Etalab committed
239
          urgency: 'high**'
240 241 242
        stretch:
          fixed_version: 2.5.6-1
          status: resolved
Etalab's avatar
Etalab committed
243
          urgency: 'high**'
244 245 246
        wheezy:
          fixed_version: 2.5.6-1
          status: resolved
Etalab's avatar
Etalab committed
247
          urgency: 'high**'
248 249
      scope: remote
    CVE-2009-1374:
Etalab's avatar
Etalab committed
250
      description: Buffer overflow in the decrypt_out function in Pidgin (formerly Gaim) before 2.5.6 allows remote attackers to cause a denial of service (application crash) via a QQ packet.
251 252 253 254
      releases:
        jessie:
          fixed_version: 2.5.6-1
          status: resolved
Etalab's avatar
Etalab committed
255
          urgency: 'medium**'
256 257 258
        sid:
          fixed_version: 2.5.6-1
          status: resolved
Etalab's avatar
Etalab committed
259
          urgency: 'medium**'
260 261 262
        squeeze:
          fixed_version: 2.5.6-1
          status: resolved
Etalab's avatar
Etalab committed
263
          urgency: 'medium**'
264 265 266
        stretch:
          fixed_version: 2.5.6-1
          status: resolved
Etalab's avatar
Etalab committed
267
          urgency: 'medium**'
268 269 270
        wheezy:
          fixed_version: 2.5.6-1
          status: resolved
Etalab's avatar
Etalab committed
271
          urgency: 'medium**'
272 273
      scope: remote
    CVE-2009-1375:
Etalab's avatar
Etalab committed
274
      description: 'The PurpleCircBuffer implementation in Pidgin (formerly Gaim) before 2.5.6 does not properly maintain a certain buffer, which allows remote attackers to cause a denial of service (memory corruption and application crash) via vectors involving the (1) XMPP or (2) Sametime protocol.'
275 276 277 278
      releases:
        jessie:
          fixed_version: 2.5.6-1
          status: resolved
Etalab's avatar
Etalab committed
279
          urgency: 'medium**'
280 281 282
        sid:
          fixed_version: 2.5.6-1
          status: resolved
Etalab's avatar
Etalab committed
283
          urgency: 'medium**'
284 285 286
        squeeze:
          fixed_version: 2.5.6-1
          status: resolved
Etalab's avatar
Etalab committed
287
          urgency: 'medium**'
288 289 290
        stretch:
          fixed_version: 2.5.6-1
          status: resolved
Etalab's avatar
Etalab committed
291
          urgency: 'medium**'
292 293 294
        wheezy:
          fixed_version: 2.5.6-1
          status: resolved
Etalab's avatar
Etalab committed
295
          urgency: 'medium**'
296 297
      scope: remote
    CVE-2009-1376:
Etalab's avatar
Etalab committed
298
      description: 'Multiple integer overflows in the msn_slplink_process_msg functions in the MSN protocol handler in (1) libpurple/protocols/msn/slplink.c and (2) libpurple/protocols/msnp9/slplink.c in Pidgin (formerly Gaim) before 2.5.6 on 32-bit platforms allow remote attackers to execute arbitrary code via a malformed SLP message with a crafted offset value, leading to buffer overflows.  NOTE: this issue exists because of an incomplete fix for CVE-2008-2927.'
299 300 301 302
      releases:
        jessie:
          fixed_version: 2.5.6-1
          status: resolved
Etalab's avatar
Etalab committed
303
          urgency: 'high**'
304 305 306
        sid:
          fixed_version: 2.5.6-1
          status: resolved
Etalab's avatar
Etalab committed
307
          urgency: 'high**'
308 309 310
        squeeze:
          fixed_version: 2.5.6-1
          status: resolved
Etalab's avatar
Etalab committed
311
          urgency: 'high**'
312 313 314
        stretch:
          fixed_version: 2.5.6-1
          status: resolved
Etalab's avatar
Etalab committed
315
          urgency: 'high**'
316 317 318
        wheezy:
          fixed_version: 2.5.6-1
          status: resolved
Etalab's avatar
Etalab committed
319
          urgency: 'high**'
320 321 322
      scope: remote
    CVE-2009-1889:
      bug: 535790
Etalab's avatar
Etalab committed
323
      description: 'The OSCAR protocol implementation in Pidgin before 2.5.8 misinterprets the ICQWebMessage message type as the ICQSMS message type, which allows remote attackers to cause a denial of service (application crash) via a crafted ICQ web message that triggers allocation of a large amount of memory.'
324 325 326 327 328 329 330 331 332 333 334 335 336 337 338 339 340 341 342 343 344 345 346 347
      releases:
        jessie:
          fixed_version: 2.5.8-1
          status: resolved
          urgency: low
        sid:
          fixed_version: 2.5.8-1
          status: resolved
          urgency: low
        squeeze:
          fixed_version: 2.5.8-1
          status: resolved
          urgency: low
        stretch:
          fixed_version: 2.5.8-1
          status: resolved
          urgency: low
        wheezy:
          fixed_version: 2.5.8-1
          status: resolved
          urgency: low
      scope: remote
    CVE-2009-2694:
      bug: 542486
Etalab's avatar
Etalab committed
348
      description: 'The msn_slplink_process_msg function in libpurple/protocols/msn/slplink.c in libpurple, as used in Pidgin (formerly Gaim) before 2.5.9 and Adium 1.3.5 and earlier, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) by sending multiple crafted SLP (aka MSNSLP) messages to trigger an overwrite of an arbitrary memory location.  NOTE: this issue reportedly exists because of an incomplete fix for CVE-2009-1376.'
349 350 351 352 353 354 355 356 357 358 359 360 361 362 363 364 365 366 367 368 369 370 371
      releases:
        jessie:
          fixed_version: 2.5.9-1
          status: resolved
          urgency: medium
        sid:
          fixed_version: 2.5.9-1
          status: resolved
          urgency: medium
        squeeze:
          fixed_version: 2.5.9-1
          status: resolved
          urgency: medium
        stretch:
          fixed_version: 2.5.9-1
          status: resolved
          urgency: medium
        wheezy:
          fixed_version: 2.5.9-1
          status: resolved
          urgency: medium
      scope: remote
    CVE-2009-2703:
Etalab's avatar
Etalab committed
372
      description: libpurple/protocols/irc/msgs.c in the IRC protocol plugin in libpurple in Pidgin before 2.6.2 allows remote IRC servers to cause a denial of service (NULL pointer dereference and application crash) via a TOPIC message that lacks a topic string.
373 374 375 376 377 378 379 380 381 382 383 384 385 386 387 388 389 390 391 392 393 394 395
      releases:
        jessie:
          fixed_version: 2.6.2
          status: resolved
          urgency: low
        sid:
          fixed_version: 2.6.2
          status: resolved
          urgency: low
        squeeze:
          fixed_version: 2.6.2
          status: resolved
          urgency: low
        stretch:
          fixed_version: 2.6.2
          status: resolved
          urgency: low
        wheezy:
          fixed_version: 2.6.2
          status: resolved
          urgency: low
      scope: remote
    CVE-2009-3025:
Etalab's avatar
Etalab committed
396
      description: Unspecified vulnerability in Pidgin 2.6.0 allows remote attackers to cause a denial of service (crash) via a link in a Yahoo IM.
397 398 399 400 401 402 403 404 405 406 407 408 409 410 411 412 413 414 415 416 417 418 419 420
      releases:
        jessie:
          fixed_version: 2.6.1-1
          status: resolved
          urgency: low
        sid:
          fixed_version: 2.6.1-1
          status: resolved
          urgency: low
        squeeze:
          fixed_version: 2.6.1-1
          status: resolved
          urgency: low
        stretch:
          fixed_version: 2.6.1-1
          status: resolved
          urgency: low
        wheezy:
          fixed_version: 2.6.1-1
          status: resolved
          urgency: low
      scope: remote
    CVE-2009-3026:
      bug: 542891
Etalab's avatar
Etalab committed
421
      description: 'protocols/jabber/auth.c in libpurple in Pidgin 2.6.0, and possibly other versions, does not follow the "require TLS/SSL" preference when connecting to older Jabber servers that do not follow the XMPP specification, which causes libpurple to connect to the server without the expected encryption and allows remote attackers to sniff sessions.'
422 423 424 425 426 427 428 429 430 431 432 433 434 435 436 437 438 439 440 441 442 443 444
      releases:
        jessie:
          fixed_version: 2.6.1-1
          status: resolved
          urgency: low
        sid:
          fixed_version: 2.6.1-1
          status: resolved
          urgency: low
        squeeze:
          fixed_version: 2.6.1-1
          status: resolved
          urgency: low
        stretch:
          fixed_version: 2.6.1-1
          status: resolved
          urgency: low
        wheezy:
          fixed_version: 2.6.1-1
          status: resolved
          urgency: low
      scope: remote
    CVE-2009-3083:
Etalab's avatar
Etalab committed
445
      description: 'The msn_slp_sip_recv function in libpurple/protocols/msn/slp.c in the MSN protocol plugin in libpurple in Pidgin before 2.6.2 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via an SLP invite message that lacks certain required fields, as demonstrated by a malformed message from a KMess client.'
446 447 448 449 450 451 452 453 454 455 456 457 458 459 460 461 462 463 464 465 466 467 468
      releases:
        jessie:
          fixed_version: 2.6.2-1
          status: resolved
          urgency: low
        sid:
          fixed_version: 2.6.2-1
          status: resolved
          urgency: low
        squeeze:
          fixed_version: 2.6.2-1
          status: resolved
          urgency: low
        stretch:
          fixed_version: 2.6.2-1
          status: resolved
          urgency: low
        wheezy:
          fixed_version: 2.6.2-1
          status: resolved
          urgency: low
      scope: remote
    CVE-2009-3084:
Etalab's avatar
Etalab committed
469
      description: 'The msn_slp_process_msg function in libpurple/protocols/msn/slpcall.c in the MSN protocol plugin in libpurple 2.6.0 and 2.6.1, as used in Pidgin before 2.6.2, allows remote attackers to cause a denial of service (application crash) via a handwritten (aka Ink) message, related to an uninitialized variable and the incorrect "UTF16-LE" charset name.'
470 471 472 473 474 475 476 477 478 479 480 481 482 483 484 485 486 487 488 489 490 491 492
      releases:
        jessie:
          fixed_version: 2.6.2-1
          status: resolved
          urgency: low
        sid:
          fixed_version: 2.6.2-1
          status: resolved
          urgency: low
        squeeze:
          fixed_version: 2.6.2-1
          status: resolved
          urgency: low
        stretch:
          fixed_version: 2.6.2-1
          status: resolved
          urgency: low
        wheezy:
          fixed_version: 2.6.2-1
          status: resolved
          urgency: low
      scope: remote
    CVE-2009-3085:
Etalab's avatar
Etalab committed
493
      description: 'The XMPP protocol plugin in libpurple in Pidgin before 2.6.2 does not properly handle an error IQ stanza during an attempted fetch of a custom smiley, which allows remote attackers to cause a denial of service (application crash) via XHTML-IM content with cid: images.'
494 495 496 497 498 499 500 501 502 503 504 505 506 507 508 509 510 511 512 513 514 515 516
      releases:
        jessie:
          fixed_version: 2.6.2-1
          status: resolved
          urgency: low
        sid:
          fixed_version: 2.6.2-1
          status: resolved
          urgency: low
        squeeze:
          fixed_version: 2.6.2-1
          status: resolved
          urgency: low
        stretch:
          fixed_version: 2.6.2-1
          status: resolved
          urgency: low
        wheezy:
          fixed_version: 2.6.2-1
          status: resolved
          urgency: low
      scope: remote
    CVE-2009-3615:
Etalab's avatar
Etalab committed
517
      description: 'The OSCAR protocol plugin in libpurple in Pidgin before 2.6.3 and Adium before 1.3.7 allows remote attackers to cause a denial of service (application crash) via crafted contact-list data for (1) ICQ and possibly (2) AIM, as demonstrated by the SIM IM client.'
518 519 520 521
      releases:
        jessie:
          fixed_version: 2.6.3-1
          status: resolved
Etalab's avatar
Etalab committed
522
          urgency: 'medium**'
523 524 525
        sid:
          fixed_version: 2.6.3-1
          status: resolved
Etalab's avatar
Etalab committed
526
          urgency: 'medium**'
527 528 529
        squeeze:
          fixed_version: 2.6.3-1
          status: resolved
Etalab's avatar
Etalab committed
530
          urgency: 'medium**'
531 532 533
        stretch:
          fixed_version: 2.6.3-1
          status: resolved
Etalab's avatar
Etalab committed
534
          urgency: 'medium**'
535 536 537
        wheezy:
          fixed_version: 2.6.3-1
          status: resolved
Etalab's avatar
Etalab committed
538
          urgency: 'medium**'
539 540 541
      scope: remote
    CVE-2010-0013:
      bug: 563206
Etalab's avatar
Etalab committed
542
      description: 'Directory traversal vulnerability in slp.c in the MSN protocol plugin in libpurple in Pidgin 2.6.4 and Adium 1.3.8 allows remote attackers to read arbitrary files via a .. (dot dot) in an application/x-msnmsgrp2p MSN emoticon (aka custom smiley) request, a related issue to CVE-2004-0122.  NOTE: it could be argued that this is resultant from a vulnerability in which an emoticon download request is processed even without a preceding text/x-mms-emoticon message that announced availability of the emoticon.'
543 544 545 546 547 548 549 550 551 552 553 554 555 556 557 558 559 560 561 562 563 564 565 566
      releases:
        jessie:
          fixed_version: 2.6.5-1
          status: resolved
          urgency: medium
        sid:
          fixed_version: 2.6.5-1
          status: resolved
          urgency: medium
        squeeze:
          fixed_version: 2.6.5-1
          status: resolved
          urgency: medium
        stretch:
          fixed_version: 2.6.5-1
          status: resolved
          urgency: medium
        wheezy:
          fixed_version: 2.6.5-1
          status: resolved
          urgency: medium
      scope: remote
    CVE-2010-0277:
      bug: 566775
Etalab's avatar
Etalab committed
567
      description: 'slp.c in the MSN protocol plugin in libpurple in Pidgin before 2.6.6, including 2.6.4, and Adium 1.3.8 allows remote attackers to cause a denial of service (memory corruption and application crash) or possibly have unspecified other impact via a malformed MSNSLP INVITE request in an SLP message, a different issue than CVE-2010-0013.'
568 569 570 571 572 573 574 575 576 577 578 579 580 581 582 583 584 585 586 587 588 589 590 591
      releases:
        jessie:
          fixed_version: 2.6.6-1
          status: resolved
          urgency: low
        sid:
          fixed_version: 2.6.6-1
          status: resolved
          urgency: low
        squeeze:
          fixed_version: 2.6.6-1
          status: resolved
          urgency: low
        stretch:
          fixed_version: 2.6.6-1
          status: resolved
          urgency: low
        wheezy:
          fixed_version: 2.6.6-1
          status: resolved
          urgency: low
      scope: remote
    CVE-2010-0420:
      bug: 572946
Etalab's avatar
Etalab committed
592
      description: 'libpurple in Finch in Pidgin before 2.6.6, when an XMPP multi-user chat (MUC) room is used, does not properly parse nicknames containing <br> sequences, which allows remote attackers to cause a denial of service (application crash) via a crafted nickname.'
593 594 595 596 597 598 599 600 601 602 603 604 605 606 607 608 609 610 611 612 613 614 615 616
      releases:
        jessie:
          fixed_version: 2.6.6-1
          status: resolved
          urgency: low
        sid:
          fixed_version: 2.6.6-1
          status: resolved
          urgency: low
        squeeze:
          fixed_version: 2.6.6-1
          status: resolved
          urgency: low
        stretch:
          fixed_version: 2.6.6-1
          status: resolved
          urgency: low
        wheezy:
          fixed_version: 2.6.6-1
          status: resolved
          urgency: low
      scope: remote
    CVE-2010-0423:
      bug: 572946
Etalab's avatar
Etalab committed
617
      description: gtkimhtml.c in Pidgin before 2.6.6 allows remote attackers to cause a denial of service (CPU consumption and application hang) by sending many smileys in a (1) IM or (2) chat.
618 619 620 621 622 623 624 625 626 627 628 629 630 631 632 633 634 635 636 637 638 639 640
      releases:
        jessie:
          fixed_version: 2.6.6-1
          status: resolved
          urgency: low
        sid:
          fixed_version: 2.6.6-1
          status: resolved
          urgency: low
        squeeze:
          fixed_version: 2.6.6-1
          status: resolved
          urgency: low
        stretch:
          fixed_version: 2.6.6-1
          status: resolved
          urgency: low
        wheezy:
          fixed_version: 2.6.6-1
          status: resolved
          urgency: low
      scope: remote
    CVE-2010-1624:
Etalab's avatar
Etalab committed
641
      description: The msn_emoticon_msg function in slp.c in the MSN protocol plugin in libpurple in Pidgin before 2.7.0 allows remote authenticated users to cause a denial of service (NULL pointer dereference and application crash) via a custom emoticon in a malformed SLP message.
642 643 644 645 646 647 648 649 650 651 652 653 654 655 656 657 658 659 660 661 662 663 664
      releases:
        jessie:
          fixed_version: 2.7.0-1
          status: resolved
          urgency: low
        sid:
          fixed_version: 2.7.0-1
          status: resolved
          urgency: low
        squeeze:
          fixed_version: 2.7.0-1
          status: resolved
          urgency: low
        stretch:
          fixed_version: 2.7.0-1
          status: resolved
          urgency: low
        wheezy:
          fixed_version: 2.7.0-1
          status: resolved
          urgency: low
      scope: remote
    CVE-2010-2528:
Etalab's avatar
Etalab committed
665
      description: The clientautoresp function in family_icbm.c in the oscar protocol plugin in libpurple in Pidgin before 2.7.2 allows remote authenticated users to cause a denial of service (NULL pointer dereference and application crash) via an X-Status message that lacks the expected end tag for a (1) desc or (2) title element.
666 667 668 669
      releases:
        jessie:
          fixed_version: 2.7.2-1
          status: resolved
Etalab's avatar
Etalab committed
670
          urgency: 'medium**'
671 672 673
        sid:
          fixed_version: 2.7.2-1
          status: resolved
Etalab's avatar
Etalab committed
674
          urgency: 'medium**'
675 676 677
        squeeze:
          fixed_version: 2.7.2-1
          status: resolved
Etalab's avatar
Etalab committed
678
          urgency: 'medium**'
679 680 681
        stretch:
          fixed_version: 2.7.2-1
          status: resolved
Etalab's avatar
Etalab committed
682
          urgency: 'medium**'
683 684 685
        wheezy:
          fixed_version: 2.7.2-1
          status: resolved
Etalab's avatar
Etalab committed
686
          urgency: 'medium**'
687 688
      scope: remote
    CVE-2010-3711:
Etalab's avatar
Etalab committed
689
      description: 'libpurple in Pidgin before 2.7.4 does not properly validate the return value of the purple_base64_decode function, which allows remote authenticated users to cause a denial of service (NULL pointer dereference and application crash) via a crafted message, related to the plugins for MSN, MySpaceIM, XMPP, and Yahoo! and the NTLM authentication support.'
690 691 692 693
      releases:
        jessie:
          fixed_version: 2.7.4-1
          status: resolved
Etalab's avatar
Etalab committed
694
          urgency: 'medium**'
695 696 697
        sid:
          fixed_version: 2.7.4-1
          status: resolved
Etalab's avatar
Etalab committed
698
          urgency: 'medium**'
699 700 701
        squeeze:
          fixed_version: 2.7.3-1+squeeze1
          status: resolved
Etalab's avatar
Etalab committed
702
          urgency: 'medium**'
703 704 705
        stretch:
          fixed_version: 2.7.4-1
          status: resolved
Etalab's avatar
Etalab committed
706
          urgency: 'medium**'
707 708 709
        wheezy:
          fixed_version: 2.7.4-1
          status: resolved
Etalab's avatar
Etalab committed
710
          urgency: 'medium**'
711 712 713
      scope: remote
    CVE-2010-4528:
      bug: 608331
Etalab's avatar
Etalab committed
714
      description: directconn.c in the MSN protocol plugin in libpurple 2.7.6 through 2.7.8 in Pidgin before 2.7.9 allows remote authenticated users to cause a denial of service (NULL pointer dereference and application crash) via a short p2pv2 packet in a DirectConnect (aka direct connection) session.
715 716 717 718 719 720 721 722 723 724 725 726 727 728 729 730 731 732 733 734 735 736 737
      releases:
        jessie:
          fixed_version: 2.7.9-1
          status: resolved
          urgency: medium
        sid:
          fixed_version: 2.7.9-1
          status: resolved
          urgency: medium
        squeeze:
          fixed_version: '0'
          status: resolved
          urgency: unimportant
        stretch:
          fixed_version: 2.7.9-1
          status: resolved
          urgency: medium
        wheezy:
          fixed_version: 2.7.9-1
          status: resolved
          urgency: medium
      scope: remote
    CVE-2011-1091:
Etalab's avatar
Etalab committed
738
      description: 'libymsg.c in the Yahoo! protocol plugin in libpurple in Pidgin 2.6.0 through 2.7.10 allows (1) remote authenticated users to cause a denial of service (NULL pointer dereference and application crash) via a malformed YMSG notification packet, and allows (2) remote Yahoo! servers to cause a denial of service (NULL pointer dereference and application crash) via a malformed YMSG SMS message.'
739 740 741 742 743 744 745 746 747 748 749 750 751 752 753 754 755 756 757 758 759 760 761 762
      releases:
        jessie:
          fixed_version: 2.7.11-1
          status: resolved
          urgency: low
        sid:
          fixed_version: 2.7.11-1
          status: resolved
          urgency: low
        squeeze:
          nodsa: Minor issue
          status: open
          urgency: low
        stretch:
          fixed_version: 2.7.11-1
          status: resolved
          urgency: low
        wheezy:
          fixed_version: 2.7.11-1
          status: resolved
          urgency: low
      scope: remote
    CVE-2011-2943:
      bug: 638709
Etalab's avatar
Etalab committed
763
      description: 'The irc_msg_who function in msgs.c in the IRC protocol plugin in libpurple 2.8.0 through 2.9.0 in Pidgin before 2.10.0 does not properly validate characters in nicknames, which allows user-assisted remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted nickname that is not properly handled in a WHO response.'
764 765 766 767
      releases:
        jessie:
          fixed_version: 2.10.0-1
          status: resolved
Etalab's avatar
Etalab committed
768
          urgency: 'medium**'
769 770 771
        sid:
          fixed_version: 2.10.0-1
          status: resolved
Etalab's avatar
Etalab committed
772
          urgency: 'medium**'
773 774 775 776 777 778 779
        squeeze:
          fixed_version: '0'
          status: resolved
          urgency: unimportant
        stretch:
          fixed_version: 2.10.0-1
          status: resolved
Etalab's avatar
Etalab committed
780
          urgency: 'medium**'
781 782 783
        wheezy:
          fixed_version: 2.10.0-1
          status: resolved
Etalab's avatar
Etalab committed
784
          urgency: 'medium**'
785 786
      scope: remote
    CVE-2011-3184:
Etalab's avatar
Etalab committed
787
      description: 'The msn_httpconn_parse_data function in httpconn.c in the MSN protocol plugin in libpurple in Pidgin before 2.10.0 does not properly handle HTTP 100 responses, which allows remote attackers to cause a denial of service (incorrect memory access and application crash) via vectors involving a crafted server message.'
788 789 790 791 792 793 794 795 796 797 798 799 800 801 802 803 804 805 806 807 808 809
      releases:
        jessie:
          fixed_version: 2.10.0-1
          status: resolved
          urgency: unimportant
        sid:
          fixed_version: 2.10.0-1
          status: resolved
          urgency: unimportant
        squeeze:
          status: open
          urgency: unimportant
        stretch:
          fixed_version: 2.10.0-1
          status: resolved
          urgency: unimportant
        wheezy:
          fixed_version: 2.10.0-1
          status: resolved
          urgency: unimportant
      scope: remote
    CVE-2011-3185:
Etalab's avatar
Etalab committed
810
      description: 'gtkutils.c in Pidgin before 2.10.0 on Windows allows user-assisted remote attackers to execute arbitrary programs via a file: URL in a message.'
811 812 813 814 815 816 817 818 819 820 821 822 823 824 825 826 827 828 829 830 831 832 833
      releases:
        jessie:
          fixed_version: '0'
          status: resolved
          urgency: unimportant
        sid:
          fixed_version: '0'
          status: resolved
          urgency: unimportant
        squeeze:
          fixed_version: '0'
          status: resolved
          urgency: unimportant
        stretch:
          fixed_version: '0'
          status: resolved
          urgency: unimportant
        wheezy:
          fixed_version: '0'
          status: resolved
          urgency: unimportant
      scope: remote
    CVE-2011-3594:
Etalab's avatar
Etalab committed
834
      description: 'The g_markup_escape_text function in the SILC protocol plug-in in libpurple 2.10.0 and earlier, as used in Pidgin and possibly other products, allows remote attackers to cause a denial of service (crash) via invalid UTF-8 sequences that trigger use of invalid pointers and an out-of-bounds read, related to interactions with certain versions of glib2.'
835 836 837 838 839 840 841 842 843 844 845 846
      releases:
        jessie:
          fixed_version: 2.10.1-1
          status: resolved
          urgency: unimportant
        sid:
          fixed_version: 2.10.1-1
          status: resolved
          urgency: unimportant
        squeeze:
          fixed_version: 2.7.3-1+squeeze2
          status: resolved
Etalab's avatar
Etalab committed
847
          urgency: 'medium**'
848 849 850 851 852 853 854 855 856
        stretch:
          fixed_version: 2.10.1-1
          status: resolved
          urgency: unimportant
        wheezy:
          fixed_version: 2.10.1-1
          status: resolved
          urgency: unimportant
      scope: remote
Etalab's avatar
Etalab committed
857 858
    CVE-2007-4999:
      description: 'libpurple in Pidgin 2.1.0 through 2.2.1, when using HTML logging, allows remote attackers to cause a denial of service (NULL dereference and application crash) via a message that contains invalid HTML data, a different vector than CVE-2007-4996.'
859 860
      releases:
        jessie:
Etalab's avatar
Etalab committed
861
          fixed_version: 2.2.2-1
862
          status: resolved
Etalab's avatar
Etalab committed
863
          urgency: medium
864
        sid:
Etalab's avatar
Etalab committed
865
          fixed_version: 2.2.2-1
866
          status: resolved
Etalab's avatar
Etalab committed
867
          urgency: medium
868
        squeeze:
Etalab's avatar
Etalab committed
869
          fixed_version: 2.2.2-1
870
          status: resolved
Etalab's avatar
Etalab committed
871
          urgency: medium
872
        stretch:
Etalab's avatar
Etalab committed
873
          fixed_version: 2.2.2-1
874
          status: resolved
Etalab's avatar
Etalab committed
875
          urgency: medium
876
        wheezy:
Etalab's avatar
Etalab committed
877
          fixed_version: 2.2.2-1
878
          status: resolved
Etalab's avatar
Etalab committed
879
          urgency: medium
880 881
      scope: remote
    CVE-2011-4602:
Etalab's avatar
Etalab committed
882
      description: 'The XMPP protocol plugin in libpurple in Pidgin before 2.10.1 does not properly handle missing fields in (1) voice-chat and (2) video-chat stanzas, which allows remote attackers to cause a denial of service (application crash) via a crafted message.'
883 884 885 886 887 888 889 890 891 892 893 894
      releases:
        jessie:
          fixed_version: 2.10.1-1
          status: resolved
          urgency: low
        sid:
          fixed_version: 2.10.1-1
          status: resolved
          urgency: low
        squeeze:
          fixed_version: 2.7.3-1+squeeze2
          status: resolved
Etalab's avatar
Etalab committed
895
          urgency: 'medium**'
896 897 898 899 900 901 902 903 904 905
        stretch:
          fixed_version: 2.10.1-1
          status: resolved
          urgency: low
        wheezy:
          fixed_version: 2.10.1-1
          status: resolved
          urgency: low
      scope: remote
    CVE-2011-4603:
Etalab's avatar
Etalab committed
906
      description: 'The silc_channel_message function in ops.c in the SILC protocol plugin in libpurple in Pidgin before 2.10.1 does not perform the expected UTF-8 validation on message data, which allows remote attackers to cause a denial of service (application crash) via a crafted message, a different vulnerability than CVE-2011-3594.'
907 908 909 910 911 912 913 914 915 916 917 918
      releases:
        jessie:
          fixed_version: 2.10.1-1
          status: resolved
          urgency: low
        sid:
          fixed_version: 2.10.1-1
          status: resolved
          urgency: low
        squeeze:
          fixed_version: 2.7.3-1+squeeze2
          status: resolved
Etalab's avatar
Etalab committed
919
          urgency: 'medium**'
920 921 922 923 924 925 926 927 928 929
        stretch:
          fixed_version: 2.10.1-1
          status: resolved
          urgency: low
        wheezy:
          fixed_version: 2.10.1-1
          status: resolved
          urgency: low
      scope: remote
    CVE-2011-4922:
Etalab's avatar
Etalab committed
930
      description: 'cipher.c in the Cipher API in libpurple in Pidgin before 2.7.10 retains encryption-key data in process memory, which might allow local users to obtain sensitive information by reading a core file or other representation of memory contents.'
931 932 933 934 935 936 937 938 939 940 941 942 943 944 945 946 947 948 949 950 951 952 953 954
      releases:
        jessie:
          fixed_version: 2.7.11-1
          status: resolved
          urgency: low
        sid:
          fixed_version: 2.7.11-1
          status: resolved
          urgency: low
        squeeze:
          nodsa: Minor issue
          status: open
          urgency: low
        stretch:
          fixed_version: 2.7.11-1
          status: resolved
          urgency: low
        wheezy:
          fixed_version: 2.7.11-1
          status: resolved
          urgency: low
      scope: local
    CVE-2011-4939:
      bug: 664028
Etalab's avatar
Etalab committed
955
      description: The pidgin_conv_chat_rename_user function in gtkconv.c in Pidgin before 2.10.2 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) by changing a nickname while in an XMPP chat room.
956 957 958 959
      releases:
        jessie:
          fixed_version: 2.10.2-1
          status: resolved
Etalab's avatar
Etalab committed
960
          urgency: 'medium**'
961 962 963
        sid:
          fixed_version: 2.10.2-1
          status: resolved
Etalab's avatar
Etalab committed
964
          urgency: 'medium**'
965 966 967 968 969 970 971
        squeeze:
          fixed_version: '0'
          status: resolved
          urgency: unimportant
        stretch:
          fixed_version: 2.10.2-1
          status: resolved
Etalab's avatar
Etalab committed
972
          urgency: 'medium**'
973 974 975
        wheezy:
          fixed_version: 2.10.2-1
          status: resolved
Etalab's avatar
Etalab committed
976
          urgency: 'medium**'
977 978 979
      scope: remote
    CVE-2012-1178:
      bug: 664030
Etalab's avatar
Etalab committed
980
      description: The msn_oim_report_to_user function in oim.c in the MSN protocol plugin in libpurple in Pidgin before 2.10.2 allows remote servers to cause a denial of service (application crash) via an OIM message that lacks UTF-8 encoding.
981 982 983 984 985 986 987 988 989 990 991 992 993 994 995 996 997 998 999 1000 1001 1002 1003 1004 1005 1006 1007 1008 1009 1010 1011 1012 1013 1014 1015 1016 1017 1018 1019 1020
      releases:
        jessie:
          fixed_version: 2.10.2-1
          status: resolved
          urgency: low
        sid:
          fixed_version: 2.10.2-1
          status: resolved
          urgency: low
        squeeze:
          nodsa: Only exploitable by malicious server
          status: open
          urgency: low
        stretch:
          fixed_version: 2.10.2-1
          status: resolved
          urgency: low
        wheezy:
          fixed_version: 2.10.2-1
          status: resolved
          urgency: low
      scope: remote
    CVE-2012-1257:
      releases:
        jessie:
          status: open
          urgency: unimportant
        sid:
          status: open
          urgency: unimportant
        squeeze:
          status: open
          urgency: unimportant
        stretch:
          status: open
          urgency: unimportant
        wheezy:
          status: open
          urgency: unimportant
    CVE-2012-2214:
Etalab's avatar
Etalab committed
1021
      description: 'proxy.c in libpurple in Pidgin before 2.10.4 does not properly handle canceled SOCKS5 connection attempts, which allows user-assisted remote authenticated users to cause a denial of service (application crash) via a sequence of XMPP file-transfer requests.'
1022 1023 1024 1025
      releases:
        jessie:
          fixed_version: 2.10.4-1
          status: resolved
Etalab's avatar
Etalab committed
1026
          urgency: 'low**'
1027 1028 1029
        sid:
          fixed_version: 2.10.4-1
          status: resolved
Etalab's avatar
Etalab committed
1030
          urgency: 'low**'
1031 1032 1033 1034 1035 1036
        squeeze:
          status: open
          urgency: end-of-life
        stretch:
          fixed_version: 2.10.4-1
          status: resolved
Etalab's avatar
Etalab committed
1037
          urgency: 'low**'
1038 1039 1040
        wheezy:
          fixed_version: 2.10.4-1
          status: resolved
Etalab's avatar
Etalab committed
1041
          urgency: 'low**'
1042 1043
      scope: remote
    CVE-2012-2318:
Etalab's avatar
Etalab committed
1044
      description: 'msg.c in the MSN protocol plugin in libpurple in Pidgin before 2.10.4 does not properly handle crafted characters, which allows remote servers to cause a denial of service (application crash) by placing these characters in a text/plain message.'
1045 1046 1047 1048
      releases:
        jessie:
          fixed_version: 2.10.4-1
          status: resolved
Etalab's avatar
Etalab committed
1049
          urgency: 'medium**'
1050 1051 1052
        sid:
          fixed_version: 2.10.4-1
          status: resolved
Etalab's avatar
Etalab committed
1053
          urgency: 'medium**'
1054 1055 1056 1057 1058 1059
        squeeze:
          status: open
          urgency: end-of-life
        stretch:
          fixed_version: 2.10.4-1
          status: resolved
Etalab's avatar
Etalab committed
1060
          urgency: 'medium**'
1061 1062 1063
        wheezy:
          fixed_version: 2.10.4-1
          status: resolved
Etalab's avatar
Etalab committed
1064
          urgency: 'medium**'
1065 1066 1067
      scope: remote
    CVE-2012-3374:
      bug: 680661
Etalab's avatar
Etalab committed
1068
      description: Buffer overflow in markup.c in the MXit protocol plugin in libpurple in Pidgin before 2.10.5 allows remote attackers to execute arbitrary code via a crafted inline image in a message.
1069 1070 1071 1072
      releases:
        jessie:
          fixed_version: 2.10.6-1
          status: resolved
Etalab's avatar
Etalab committed
1073
          urgency: 'high**'
1074 1075 1076
        sid:
          fixed_version: 2.10.6-1
          status: resolved
Etalab's avatar
Etalab committed
1077
          urgency: 'high**'
1078 1079 1080
        squeeze:
          fixed_version: 2.7.3-1+squeeze3
          status: resolved
Etalab's avatar
Etalab committed
1081
          urgency: 'high**'
1082 1083 1084
        stretch:
          fixed_version: 2.10.6-1
          status: resolved
Etalab's avatar
Etalab committed
1085
          urgency: 'high**'
1086 1087 1088
        wheezy:
          fixed_version: 2.10.6-1
          status: resolved
Etalab's avatar
Etalab committed
1089
          urgency: 'high**'
1090 1091
      scope: remote
    CVE-2012-6152:
Etalab's avatar
Etalab committed
1092
      description: 'The Yahoo! protocol plugin in libpurple in Pidgin before 2.10.8 does not properly validate UTF-8 data, which allows remote attackers to cause a denial of service (application crash) via crafted byte sequences.'
1093 1094 1095 1096
      releases:
        jessie:
          fixed_version: 2.10.8-1
          status: resolved
Etalab's avatar
Etalab committed
1097
          urgency: 'medium**'
1098 1099 1100
        sid:
          fixed_version: 2.10.8-1
          status: resolved
Etalab's avatar
Etalab committed
1101
          urgency: 'medium**'
1102 1103 1104 1105 1106 1107
        squeeze:
          status: open
          urgency: end-of-life
        stretch:
          fixed_version: 2.10.8-1
          status: resolved
Etalab's avatar
Etalab committed
1108
          urgency: 'medium**'
1109 1110 1111
        wheezy:
          fixed_version: 2.10.8-1
          status: resolved
Etalab's avatar
Etalab committed
1112
          urgency: 'medium**'
1113 1114
      scope: remote
    CVE-2013-0271:
Etalab's avatar
Etalab committed
1115
      description: The MXit protocol plugin in libpurple in Pidgin before 2.10.7 might allow remote attackers to create or overwrite files via a crafted (1) mxit or (2) mxit/imagestrips pathname.
1116 1117 1118 1119
      releases:
        jessie:
          fixed_version: 2.10.6-3
          status: resolved
Etalab's avatar
Etalab committed
1120
          urgency: 'medium**'
1121 1122 1123
        sid:
          fixed_version: 2.10.6-3
          status: resolved
Etalab's avatar
Etalab committed
1124
          urgency: 'medium**'
1125 1126 1127 1128 1129 1130
        squeeze:
          status: open
          urgency: end-of-life
        stretch:
          fixed_version: 2.10.6-3
          status: resolved
Etalab's avatar
Etalab committed
1131
          urgency: 'medium**'
1132 1133 1134
        wheezy:
          fixed_version: 2.10.6-3
          status: resolved
Etalab's avatar
Etalab committed
1135
          urgency: 'medium**'
1136 1137
      scope: remote
    CVE-2013-0272:
Etalab's avatar
Etalab committed
1138
      description: Buffer overflow in http.c in the MXit protocol plugin in libpurple in Pidgin before 2.10.7 allows remote servers to execute arbitrary code via a long HTTP header.
1139 1140 1141 1142
      releases:
        jessie:
          fixed_version: 2.10.6-3
          status: resolved
Etalab's avatar
Etalab committed
1143
          urgency: 'medium**'
1144 1145 1146
        sid:
          fixed_version: 2.10.6-3
          status: resolved
Etalab's avatar
Etalab committed
1147
          urgency: 'medium**'
1148 1149 1150 1151 1152 1153
        squeeze:
          status: open
          urgency: end-of-life
        stretch:
          fixed_version: 2.10.6-3
          status: resolved
Etalab's avatar
Etalab committed
1154
          urgency: 'medium**'
1155 1156 1157
        wheezy:
          fixed_version: 2.10.6-3
          status: resolved
Etalab's avatar
Etalab committed
1158
          urgency: 'medium**'
1159 1160
      scope: remote
    CVE-2013-0273:
Etalab's avatar
Etalab committed
1161
      description: 'sametime.c in the Sametime protocol plugin in libpurple in Pidgin before 2.10.7 does not properly terminate long user IDs, which allows remote servers to cause a denial of service (application crash) via a crafted packet.'
1162 1163 1164 1165
      releases:
        jessie:
          fixed_version: 2.10.6-3
          status: resolved
Etalab's avatar
Etalab committed
1166
          urgency: 'medium**'
1167 1168 1169
        sid:
          fixed_version: 2.10.6-3
          status: resolved
Etalab's avatar
Etalab committed
1170
          urgency: 'medium**'
1171 1172 1173
        squeeze:
          nodsa: Not suitable for code injection
          status: open
Etalab's avatar
Etalab committed
1174
          urgency: 'medium**'
1175 1176 1177
        stretch:
          fixed_version: 2.10.6-3
          status: resolved
Etalab's avatar
Etalab committed
1178
          urgency: 'medium**'
1179 1180 1181
        wheezy:
          fixed_version: 2.10.6-3
          status: resolved
Etalab's avatar
Etalab committed
1182
          urgency: 'medium**'
1183 1184
      scope: remote
    CVE-2013-0274:
Etalab's avatar
Etalab committed
1185
      description: 'upnp.c in libpurple in Pidgin before 2.10.7 does not properly terminate long strings in UPnP responses, which allows remote attackers to cause a denial of service (application crash) by leveraging access to the local network.'
1186 1187 1188 1189
      releases:
        jessie:
          fixed_version: 2.10.6-3
          status: resolved
Etalab's avatar
Etalab committed
1190
          urgency: 'low**'
1191 1192 1193
        sid:
          fixed_version: 2.10.6-3
          status: resolved
Etalab's avatar
Etalab committed
1194
          urgency: 'low**'
1195 1196 1197 1198 1199 1200
        squeeze:
          status: open
          urgency: end-of-life
        stretch:
          fixed_version: 2.10.6-3
          status: resolved
Etalab's avatar
Etalab committed
1201
          urgency: 'low**'
1202 1203 1204
        wheezy:
          fixed_version: 2.10.6-3
          status: resolved
Etalab's avatar
Etalab committed
1205
          urgency: 'low**'
1206 1207
      scope: remote
    CVE-2013-6477:
Etalab's avatar
Etalab committed
1208
      description: Multiple integer signedness errors in libpurple in Pidgin before 2.10.8 allow remote attackers to cause a denial of service (application crash) via a crafted timestamp value in an XMPP message.
1209 1210 1211 1212
      releases:
        jessie:
          fixed_version: 2.10.8-1
          status: resolved
Etalab's avatar
Etalab committed
1213
          urgency: 'medium**'
1214 1215 1216
        sid:
          fixed_version: 2.10.8-1
          status: resolved
Etalab's avatar
Etalab committed
1217
          urgency: 'medium**'
1218 1219 1220
        squeeze:
          nodsa: Not suitable for code injection
          status: open
Etalab's avatar
Etalab committed
1221
          urgency: 'medium**'
1222 1223 1224
        stretch:
          fixed_version: 2.10.8-1
          status: resolved
Etalab's avatar
Etalab committed
1225
          urgency: 'medium**'
1226 1227 1228
        wheezy:
          fixed_version: 2.10.9-1~deb7u1
          status: resolved
Etalab's avatar
Etalab committed
1229
          urgency: 'medium**'
1230 1231
      scope: remote
    CVE-2013-6478:
Etalab's avatar
Etalab committed
1232
      description: 'gtkimhtml.c in Pidgin before 2.10.8 does not properly interact with underlying library support for wide Pango layouts, which allows user-assisted remote attackers to cause a denial of service (application crash) via a long URL that is examined with a tooltip.'
1233 1234 1235 1236
      releases:
        jessie:
          fixed_version: 2.10.8-1
          status: resolved
Etalab's avatar
Etalab committed
1237
          urgency: 'medium**'
1238 1239 1240
        sid:
          fixed_version: 2.10.8-1
          status: resolved
Etalab's avatar
Etalab committed
1241
          urgency: 'medium**'
1242 1243 1244 1245 1246 1247
        squeeze:
          status: open
          urgency: end-of-life
        stretch:
          fixed_version: 2.10.8-1
          status: resolved
Etalab's avatar
Etalab committed
1248
          urgency: 'medium**'
1249 1250 1251
        wheezy:
          fixed_version: 2.10.9-1~deb7u1
          status: resolved
Etalab's avatar
Etalab committed
1252
          urgency: 'medium**'
1253 1254
      scope: remote
    CVE-2013-6479:
Etalab's avatar
Etalab committed
1255
      description: 'util.c in libpurple in Pidgin before 2.10.8 does not properly allocate memory for HTTP responses that are inconsistent with the Content-Length header, which allows remote HTTP servers to cause a denial of service (application crash) via a crafted response.'
1256 1257 1258 1259
      releases:
        jessie:
          fixed_version: 2.10.8-1
          status: resolved
Etalab's avatar
Etalab committed
1260
          urgency: 'medium**'
1261 1262 1263
        sid:
          fixed_version: 2.10.8-1
          status: resolved
Etalab's avatar
Etalab committed
1264
          urgency: 'medium**'
1265 1266 1267
        squeeze:
          nodsa: Not suitable for code injection
          status: open
Etalab's avatar
Etalab committed
1268
          urgency: 'medium**'
1269 1270 1271
        stretch:
          fixed_version: 2.10.8-1
          status: resolved
Etalab's avatar
Etalab committed
1272
          urgency: 'medium**'
1273 1274 1275
        wheezy:
          fixed_version: 2.10.9-1~deb7u1
          status: resolved
Etalab's avatar
Etalab committed
1276
          urgency: 'medium**'
1277 1278
      scope: remote
    CVE-2013-6481:
Etalab's avatar
Etalab committed
1279
      description: 'libpurple/protocols/yahoo/libymsg.c in Pidgin before 2.10.8 allows remote attackers to cause a denial of service (crash) via a Yahoo! P2P message with a crafted length field, which triggers a buffer over-read.'
1280 1281 1282 1283
      releases:
        jessie:
          fixed_version: 2.10.8-1
          status: resolved
Etalab's avatar
Etalab committed
1284
          urgency: 'medium**'
1285 1286 1287
        sid:
          fixed_version: 2.10.8-1
          status: resolved
Etalab's avatar
Etalab committed
1288
          urgency: 'medium**'
1289 1290 1291 1292 1293 1294
        squeeze:
          status: open
          urgency: end-of-life
        stretch:
          fixed_version: 2.10.8-1
          status: resolved
Etalab's avatar
Etalab committed
1295
          urgency: 'medium**'
1296 1297 1298
        wheezy:
          fixed_version: 2.10.9-1~deb7u1
          status: resolved
Etalab's avatar
Etalab committed
1299
          urgency: 'medium**'
1300 1301
      scope: remote
    CVE-2013-6482:
Etalab's avatar
Etalab committed
1302
      description: 'Pidgin before 2.10.8 allows remote MSN servers to cause a denial of service (NULL pointer dereference and crash) via a crafted (1) SOAP response, (2) OIM XML response, or (3) Content-Length header.'
1303 1304 1305 1306
      releases:
        jessie:
          fixed_version: 2.10.8-1
          status: resolved
Etalab's avatar
Etalab committed
1307
          urgency: 'medium**'
1308 1309 1310
        sid:
          fixed_version: 2.10.8-1
          status: resolved
Etalab's avatar
Etalab committed
1311
          urgency: 'medium**'
1312 1313 1314 1315 1316 1317
        squeeze:
          status: open
          urgency: end-of-life
        stretch:
          fixed_version: 2.10.8-1
          status: resolved
Etalab's avatar
Etalab committed
1318
          urgency: 'medium**'
1319 1320 1321
        wheezy:
          fixed_version: 2.10.9-1~deb7u1
          status: resolved
Etalab's avatar
Etalab committed
1322
          urgency: 'medium**'
1323 1324
      scope: remote
    CVE-2013-6483:
Etalab's avatar
Etalab committed
1325
      description: 'The XMPP protocol plugin in libpurple in Pidgin before 2.10.8 does not properly determine whether the from address in an iq reply is consistent with the to address in an iq request, which allows remote attackers to spoof iq traffic or cause a denial of service (NULL pointer dereference and application crash) via a crafted reply.'
1326 1327 1328 1329
      releases:
        jessie:
          fixed_version: 2.10.8-1
          status: resolved
Etalab's avatar
Etalab committed
1330
          urgency: 'medium**'
1331 1332 1333
        sid:
          fixed_version: 2.10.8-1
          status: resolved
Etalab's avatar
Etalab committed
1334
          urgency: 'medium**'
1335 1336 1337
        squeeze:
          nodsa: Not suitable for code injection
          status: open
Etalab's avatar
Etalab committed
1338
          urgency: 'medium**'
1339 1340 1341
        stretch:
          fixed_version: 2.10.8-1
          status: resolved
Etalab's avatar
Etalab committed
1342
          urgency: 'medium**'
1343 1344 1345
        wheezy:
          fixed_version: 2.10.9-1~deb7u1
          status: resolved
Etalab's avatar
Etalab committed
1346
          urgency: 'medium**'
1347 1348
      scope: remote
    CVE-2013-6484:
Etalab's avatar
Etalab committed
1349
      description: The STUN protocol implementation in libpurple in Pidgin before 2.10.8 allows remote STUN servers to cause a denial of service (out-of-bounds write operation and application crash) by triggering a socket read error.
1350 1351 1352 1353
      releases:
        jessie:
          fixed_version: 2.10.8-1
          status: resolved
Etalab's avatar
Etalab committed
1354
          urgency: 'medium**'
1355 1356 1357
        sid:
          fixed_version: 2.10.8-1
          status: resolved
Etalab's avatar
Etalab committed
1358
          urgency: 'medium**'
1359 1360 1361 1362 1363 1364
        squeeze:
          status: open
          urgency: end-of-life
        stretch:
          fixed_version: 2.10.8-1
          status: resolved
Etalab's avatar
Etalab committed
1365
          urgency: 'medium**'
1366 1367 1368
        wheezy:
          fixed_version: 2.10.9-1~deb7u1
          status: resolved
Etalab's avatar
Etalab committed
1369
          urgency: 'medium**'
1370 1371
      scope: remote
    CVE-2013-6485: