Issued:
2009-07-02
Updated:
2009-07-02

RHSA-2009:1139 - Security Advisory

Synopsis

Moderate: pidgin security and bug fix update

Type/Severity

Security Advisory: Moderate

Topic

Updated pidgin packages that fix one security issue and one bug are now
available for Red Hat Enterprise Linux 4 and 5.

This update has been rated as having moderate security impact by the Red
Hat Security Response Team.

Description

Pidgin is an instant messaging program which can log in to multiple
accounts on multiple instant messaging networks simultaneously. The AOL
Open System for CommunicAtion in Realtime (OSCAR) protocol is used by the
AOL ICQ and AIM instant messaging systems.

A denial of service flaw was found in the Pidgin OSCAR protocol
implementation. If a remote ICQ user sent a web message to a local Pidgin
user using this protocol, it would cause excessive memory usage, leading to
a denial of service (Pidgin crash). (CVE-2009-1889)

These updated packages also fix the following bug:

  • the Yahoo! Messenger Protocol changed, making it incompatible (and
    unusable) with Pidgin versions prior to 2.5.7. This update provides Pidgin
    2.5.8, which implements version 16 of the Yahoo! Messenger Protocol, which
    resolves this issue.

Note: These packages upgrade Pidgin to version 2.5.8. Refer to the Pidgin
release notes for a full list of changes:
http://developer.pidgin.im/wiki/ChangeLog

All Pidgin users should upgrade to these updated packages, which correct
these issues. Pidgin must be restarted for this update to take effect.

Solution

Before applying this update, make sure that all previously-released
errata relevant to your system have been applied.

This update is available via Red Hat Network. Details on how to use
the Red Hat Network to apply this update are available at
http://kbase.redhat.com/faq/docs/DOC-11259

Affected Products

  • Red Hat Enterprise Linux Server 5 x86_64
  • Red Hat Enterprise Linux Server 5 i386
  • Red Hat Enterprise Linux Server 4 x86_64
  • Red Hat Enterprise Linux Server 4 ia64
  • Red Hat Enterprise Linux Server 4 i386
  • Red Hat Enterprise Linux Server - Extended Update Support 5.3 x86_64
  • Red Hat Enterprise Linux Server - Extended Update Support 5.3 i386
  • Red Hat Enterprise Linux Server - Extended Update Support 4.8 x86_64
  • Red Hat Enterprise Linux Server - Extended Update Support 4.8 ia64
  • Red Hat Enterprise Linux Server - Extended Update Support 4.8 i386
  • Red Hat Enterprise Linux Workstation 5 x86_64
  • Red Hat Enterprise Linux Workstation 5 i386
  • Red Hat Enterprise Linux Workstation 4 x86_64
  • Red Hat Enterprise Linux Workstation 4 ia64
  • Red Hat Enterprise Linux Workstation 4 i386
  • Red Hat Enterprise Linux Desktop 5 x86_64
  • Red Hat Enterprise Linux Desktop 5 i386
  • Red Hat Enterprise Linux Desktop 4 x86_64
  • Red Hat Enterprise Linux Desktop 4 i386
  • Red Hat Enterprise Linux for Power, big endian 4 ppc
  • Red Hat Enterprise Linux for Power, big endian - Extended Update Support 4.8 ppc
  • Red Hat Enterprise Linux Server from RHUI 5 x86_64
  • Red Hat Enterprise Linux Server from RHUI 5 i386

Fixes

  • BZ - 508271 - pidgin Yahoo protocol 16 [rhel-4.8.z]
  • BZ - 508272 - pidgin Yahoo protocol 16 [rhel-5.3.z]
  • BZ - 508738 - CVE-2009-1889 pidgin: DoS via specially-crafted ICQWebMessage

CVEs

References

Red Hat Enterprise Linux Server 5

SRPM
x86_64
finch-devel-2.5.8-1.el5.i386.rpm SHA-256: 70502f69909d9e71ebaa659c6c291010d0af4faafe7ea18cf492efa4f6caf2cf
finch-devel-2.5.8-1.el5.x86_64.rpm SHA-256: b7cf6822857631bccdc29439c5919808c36221ac0cf95a7f02012724abaa31ae
libpurple-devel-2.5.8-1.el5.i386.rpm SHA-256: 5ba2b7dd8b57051ca29a2268b07b9d8e1decd5b25ffd94b86af8d4996ed38bca
libpurple-devel-2.5.8-1.el5.x86_64.rpm SHA-256: b057e70ffbd51bf8dbd61734523926edea2f60f74d87a1b26fb078719bc9be3c
pidgin-devel-2.5.8-1.el5.i386.rpm SHA-256: 6ccb499019b98782b8f21dccb9d285a91533ee577401c4af50f6380af183dd0f
pidgin-devel-2.5.8-1.el5.x86_64.rpm SHA-256: 12d61a294651b68d6148826f967cd0e18959c6f53b77920621fcf44d0037d5b2
i386
finch-devel-2.5.8-1.el5.i386.rpm SHA-256: 70502f69909d9e71ebaa659c6c291010d0af4faafe7ea18cf492efa4f6caf2cf
libpurple-devel-2.5.8-1.el5.i386.rpm SHA-256: 5ba2b7dd8b57051ca29a2268b07b9d8e1decd5b25ffd94b86af8d4996ed38bca
pidgin-devel-2.5.8-1.el5.i386.rpm SHA-256: 6ccb499019b98782b8f21dccb9d285a91533ee577401c4af50f6380af183dd0f

Red Hat Enterprise Linux Workstation 5

SRPM
x86_64
finch-devel-2.5.8-1.el5.i386.rpm SHA-256: 70502f69909d9e71ebaa659c6c291010d0af4faafe7ea18cf492efa4f6caf2cf
finch-devel-2.5.8-1.el5.x86_64.rpm SHA-256: b7cf6822857631bccdc29439c5919808c36221ac0cf95a7f02012724abaa31ae
libpurple-devel-2.5.8-1.el5.i386.rpm SHA-256: 5ba2b7dd8b57051ca29a2268b07b9d8e1decd5b25ffd94b86af8d4996ed38bca
libpurple-devel-2.5.8-1.el5.x86_64.rpm SHA-256: b057e70ffbd51bf8dbd61734523926edea2f60f74d87a1b26fb078719bc9be3c
pidgin-devel-2.5.8-1.el5.i386.rpm SHA-256: 6ccb499019b98782b8f21dccb9d285a91533ee577401c4af50f6380af183dd0f
pidgin-devel-2.5.8-1.el5.x86_64.rpm SHA-256: 12d61a294651b68d6148826f967cd0e18959c6f53b77920621fcf44d0037d5b2
i386
finch-devel-2.5.8-1.el5.i386.rpm SHA-256: 70502f69909d9e71ebaa659c6c291010d0af4faafe7ea18cf492efa4f6caf2cf
libpurple-devel-2.5.8-1.el5.i386.rpm SHA-256: 5ba2b7dd8b57051ca29a2268b07b9d8e1decd5b25ffd94b86af8d4996ed38bca
pidgin-devel-2.5.8-1.el5.i386.rpm SHA-256: 6ccb499019b98782b8f21dccb9d285a91533ee577401c4af50f6380af183dd0f

Red Hat Enterprise Linux Server from RHUI 5

SRPM
x86_64
finch-devel-2.5.8-1.el5.i386.rpm SHA-256: 70502f69909d9e71ebaa659c6c291010d0af4faafe7ea18cf492efa4f6caf2cf
finch-devel-2.5.8-1.el5.x86_64.rpm SHA-256: b7cf6822857631bccdc29439c5919808c36221ac0cf95a7f02012724abaa31ae
libpurple-devel-2.5.8-1.el5.i386.rpm SHA-256: 5ba2b7dd8b57051ca29a2268b07b9d8e1decd5b25ffd94b86af8d4996ed38bca
libpurple-devel-2.5.8-1.el5.x86_64.rpm SHA-256: b057e70ffbd51bf8dbd61734523926edea2f60f74d87a1b26fb078719bc9be3c
pidgin-devel-2.5.8-1.el5.i386.rpm SHA-256: 6ccb499019b98782b8f21dccb9d285a91533ee577401c4af50f6380af183dd0f
pidgin-devel-2.5.8-1.el5.x86_64.rpm SHA-256: 12d61a294651b68d6148826f967cd0e18959c6f53b77920621fcf44d0037d5b2
i386
finch-devel-2.5.8-1.el5.i386.rpm SHA-256: 70502f69909d9e71ebaa659c6c291010d0af4faafe7ea18cf492efa4f6caf2cf
libpurple-devel-2.5.8-1.el5.i386.rpm SHA-256: 5ba2b7dd8b57051ca29a2268b07b9d8e1decd5b25ffd94b86af8d4996ed38bca
pidgin-devel-2.5.8-1.el5.i386.rpm SHA-256: 6ccb499019b98782b8f21dccb9d285a91533ee577401c4af50f6380af183dd0f

The Red Hat security contact is secalert@redhat.com. More contact details at https://access.redhat.com/security/team/contact/.