Bug 500491 (CVE-2009-1375)

Summary: CVE-2009-1375 pidgin PurpleCircBuffer corruption
Product: [Other] Security Response Reporter: Josh Bressers <bressers>
Component: vulnerabilityAssignee: Red Hat Product Security <security-response-team>
Status: CLOSED ERRATA QA Contact:
Severity: low Docs Contact:
Priority: low    
Version: unspecifiedCC: jlieskov, kreilly, mjc, security-response-team, wtogami
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
URL: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2009-1375
Whiteboard:
Fixed In Version: Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2009-06-09 07:13:49 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 500494, 500495, 500496, 500497, 502578, 833958    
Bug Blocks:    

Description Josh Bressers 2009-05-12 22:05:36 UTC
A flaw was found in the way Pidgin's PurpleCircBuffer object is expanded.
If the buffer is full when more data arrives, it results in corruption of
the data stored in the buffer. This corrupt data could possibly result in
confusing or misleading data being presented to the user, or possibly crash
Pidgin.

Comment 3 Jan Lieskovsky 2009-05-22 08:09:10 UTC
Link to upstream advisory:

http://www.pidgin.im/news/security//?id=31

Comment 4 errata-xmlrpc 2009-05-22 12:10:51 UTC
This issue has been addressed in following products:

  Red Hat Enterprise Linux 4
  Red Hat Enterprise Linux 5

Via RHSA-2009:1060 https://rhn.redhat.com/errata/RHSA-2009-1060.html

Comment 6 Fedora Update System 2009-05-26 14:31:16 UTC
pidgin-2.5.6-1.fc9 has been submitted as an update for Fedora 9.
http://admin.fedoraproject.org/updates/pidgin-2.5.6-1.fc9

Comment 7 Fedora Update System 2009-06-02 14:26:21 UTC
pidgin-2.5.6-1.fc9 has been pushed to the Fedora 9 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 8 Fedora Update System 2009-06-02 14:28:23 UTC
pidgin-2.5.6-1.fc11 has been pushed to the Fedora 11 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 9 Fedora Update System 2009-06-02 14:33:26 UTC
pidgin-2.5.6-1.fc10 has been pushed to the Fedora 10 stable repository.  If problems still persist, please make note of it in this bug report.