Pidgin 'Libpurple' Cipher API Information Disclosure Vulnerability

Bugtraq ID:	46307
Class:	Design Error
CVE:	CVE-2011-4922
Remote:	No
Local:	Yes
Published:	Feb 06 2011 12:00AM
Updated:	Sep 25 2012 02:00PM
Credit:	Julia Lawall
Vulnerable:	Ubuntu Ubuntu Linux 12.04 LTS i386 Ubuntu Ubuntu Linux 12.04 LTS amd64 Ubuntu Ubuntu Linux 11.10 i386 Ubuntu Ubuntu Linux 11.10 amd64 Ubuntu Ubuntu Linux 11.04 powerpc Ubuntu Ubuntu Linux 11.04 i386 Ubuntu Ubuntu Linux 11.04 ARM Ubuntu Ubuntu Linux 11.04 amd64 Ubuntu Ubuntu Linux 10.04 sparc Ubuntu Ubuntu Linux 10.04 powerpc Ubuntu Ubuntu Linux 10.04 i386 Ubuntu Ubuntu Linux 10.04 ARM Ubuntu Ubuntu Linux 10.04 amd64 Sun Solaris 10 Slackware Linux x86_64 -current Slackware Linux 13.1 x86_64 Slackware Linux 13.1 Slackware Linux 13.0 x86_64 Slackware Linux 13.0 Slackware Linux 12.2 Slackware Linux 12.1 Slackware Linux 12.0 Slackware Linux -current Pidgin Libpurple 2.7.9 Pidgin Libpurple 2.7.8 Pidgin Libpurple 2.7.7 Pidgin Libpurple 2.7.6 Pidgin Libpurple 2.7 Pidgin Libpurple 2.6.5 Pidgin Libpurple 2.6.4 Pidgin Libpurple 2.6.1 Pidgin Libpurple 2.6 Pidgin Libpurple 2.5.8 Pidgin Libpurple 2.5.2
Not Vulnerable:	Pidgin Libpurple 2.7.10

Pidgin 'Libpurple' Cipher API Information Disclosure Vulnerability

Pidgin is prone to an information-disclosure vulnerability.

Successful exploits may allow attackers to obtain potentially sensitive information that may aid in other attacks.

Pidgin libpurple versions prior to 2.7.10 are vulnerable.

Pidgin 'Libpurple' Cipher API Information Disclosure Vulnerability

Currently, we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Pidgin 'Libpurple' Cipher API Information Disclosure Vulnerability

Solution:
Updates are available. Please see the references for more information.


Slackware Linux x86_64 -current

• Slackware pidgin-2.7.10-x86_64-1.txz
  ftp://ftp.slackware.com/pub/slackware/slackware64-current/slackware64/ xap/pidgin-2.7.10-x86_64-1.txz

Slackware Linux 12.0

• Slackware pidgin-2.7.10-i486-1_slack12.0.tgz
  ftp://ftp.slackware.com/pub/slackware/slackware-12.0/patches/packages/ pidgin-2.7.10-i486-1_slack12.0.tgz

Slackware Linux -current

• Slackware pidgin-2.7.10-i486-1.txz
  ftp://ftp.slackware.com/pub/slackware/slackware-current/slackware/xap/ pidgin-2.7.10-i486-1.txz

Slackware Linux 12.2

• Slackware pidgin-2.7.10-i486-1_slack12.2.tgz
  ftp://ftp.slackware.com/pub/slackware/slackware-12.2/patches/packages/ pidgin-2.7.10-i486-1_slack12.2.tgz

Slackware Linux 13.1 x86_64

• Slackware pidgin-2.7.10-x86_64-1_slack13.1.txz
  ftp://ftp.slackware.com/pub/slackware/slackware64-13.1/patches/package s/pidgin-2.7.10-x86_64-1_slack13.1.txz

Slackware Linux 13.1

• Slackware pidgin-2.7.10-i486-1_slack13.1.txz
  ftp://ftp.slackware.com/pub/slackware/slackware-13.1/patches/packages/ pidgin-2.7.10-i486-1_slack13.1.txz

Slackware Linux 13.0 x86_64

• Slackware pidgin-2.7.10-x86_64-1_slack13.0.txz
  ftp://ftp.slackware.com/pub/slackware/slackware64-13.0/patches/package s/pidgin-2.7.10-x86_64-1_slack13.0.txz

Slackware Linux 12.1

• Slackware pidgin-2.7.10-i486-1_slack12.1.tgz
  ftp://ftp.slackware.com/pub/slackware/slackware-12.1/patches/packages/ pidgin-2.7.10-i486-1_slack12.1.tgz

Slackware Linux 13.0

• Slackware pidgin-2.7.10-i486-1_slack13.0.txz
  ftp://ftp.slackware.com/pub/slackware/slackware-13.0/patches/packages/ pidgin-2.7.10-i486-1_slack13.0.txz

Pidgin 'Libpurple' Cipher API Information Disclosure Vulnerability

References:

• Pidgin Homepage (Pidgin)
  
• Multiple vulnerabilities in Pidgin (Oracle)
  
• Pidgin Security Advisory (Pidgin)