Advisories MDVSA-2010:148: pidgin

[paul]

A security vulnerability has been identified and fixed in pidgin:

 

The clientautoresp function in family_icbm.c in the oscar protocol

plugin in libpurple in Pidgin before 2.7.2 allows remote authenticated

users to cause a denial of service (NULL pointer dereference and

application crash) via an X-Status message that lacks the expected

end tag for a (1) desc or (2) title element (CVE-2010-2528).

 

Packages for 2008.0 and 2009.0 are provided due to the Extended

Maintenance Program for those products.

 

This update provides pidgin 2.7.3, which is not vulnerable to this

issue.