[ GLSA 201405-22 ] Pidgin: Multiple vulnerabilities

[GLSA]

Gentoo Linux Security Advisory

Title: Pidgin: Multiple vulnerabilities (GLSA 201405-22)
Severity: high
Exploitable: remote
Date: May 18, 2014
Bug(s): #457580, #499596
ID: 201405-22

Synopsis

Multiple vulnerabilities in Pidgin may allow execution of arbitrary
code.


Background

Pidgin is a GTK Instant Messenger client for a variety of instant
messaging protocols.


Affected Packages

Package: net-im/pidgin
Vulnerable: < 2.10.9
Unaffected: >= 2.10.9
Unaffected: >= 2.10.9-r1 < 2.10.10
Architectures: All supported architectures


Description

Multiple vulnerabilities have been discovered in Pidgin. Please review
the CVE identifiers referenced below for details.


Impact

A remote attacker could possibly execute arbitrary code with the
privileges of the Pidgin process, cause a Denial of Service condition,
overwrite files, or spoof traffic.


Workaround

There is no known workaround at this time.

Resolution

All Pidgin users on HPPA or users of GNOME 3.8 and later on AMD64 or X86
should upgrade to the latest version: