USN-2390-1

Dashboard / Vulnerabilities / USN-2390-1

USN-2390-1

Summary: pidgin vulnerabilities

Details: Jacob Appelbaum and an anonymous person discovered that Pidgin incorrectly handled certificate validation. A remote attacker could exploit this to perform a machine-in-the-middle attack to view sensitive information or alter encrypted communications. (CVE-2014-3694) Yves Younan and Richard Johnson discovered that Pidgin incorrectly handled certain malformed MXit emoticons. A malicious remote server or a machine-in-the-middle could use this issue to cause Pidgin to crash, resulting in a denial of service. (CVE-2014-3695) Yves Younan and Richard Johnson discovered that Pidgin incorrectly handled certain malformed Groupwise messages. A malicious remote server or a machine-in-the-middle could use this issue to cause Pidgin to crash, resulting in a denial of service. (CVE-2014-3696) Thijs Alkemade and Paul Aurich discovered that Pidgin incorrectly handled memory when processing XMPP messages. A malicious remote server or user could use this issue to cause Pidgin to disclosure arbitrary memory, resulting in an information leak. (CVE-2014-3698)

References: https://ubuntu.com/security/notices/USN-2390-1, https://ubuntu.com/security/CVE-2014-3694, https://ubuntu.com/security/CVE-2014-3695, https://ubuntu.com/security/CVE-2014-3696, https://ubuntu.com/security/CVE-2014-3698