Bug 152916

Two HTML parsing bugs were discovered in Gaim. It is possible that a remote
attacker could send a specially crafted message to a Gaim client, causing
it to crash. The Common Vulnerabilities and Exposures project
(cve.mitre.org) has assigned the names CAN-2005-0208 and CAN-2005-0473 to
these issues.

A bug in the way Gaim processes SNAC packets was discovered. It is
possible that a remote attacker could send a specially crafted SNAC packet
to a Gaim client, causing the client to stop responding. The Common
Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name
CAN-2005-0472 to this issue.

https://rhn.redhat.com/errata/RHSA-2005-215.html



------- Additional Comments From marcdeslauriers 2005-03-10 18:14:16 ----

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Here are updated gaim packages to QA:

Changelog 7.3:
* Thu Mar 10 2005 Marc Deslauriers <marcdeslauriers>
1.1.4-0.73.1.legacy
- - Updated to 1.1.4 to fix security issues
- - Added CVS backport patches from RHEL

Changelog 9:
* Thu Mar 10 2005 Marc Deslauriers <marcdeslauriers>
1:1.1.4-0.90.1.legacy
- - Rebuilt as Fedora Legacy rh9 security update
- - Added mozilla-nspr-devel and mozilla-nss BuildRequires
- - Reverted to rh9-style desktop file
- - Disabled PIE patch

* Mon Mar 07 2005 Warren Togami <wtogami> 1:1.1.4-1.EL3.1
- - RHEL3

Changelog fc1:
* Thu Mar 10 2005 Marc Deslauriers <marcdeslauriers>
1:1.1.4-1.FC1.1.legacy
- - Rebuilt as Fedora Legacy FC1 security update

* Mon Mar 07 2005 Warren Togami <wtogami> 1:1.1.4-1.EL3.1
- - RHEL3

15309331e1032757cbf9ef6accafa9469097b204  7.3/gaim-1.1.4-0.73.1.legacy.i386.rpm
627859eb624e8c9b76b70cd4405b8fd4ac676cde  7.3/gaim-1.1.4-0.73.1.legacy.src.rpm
d4e88861a7daabaacafa134bb41a1555f0b73c82  9/gaim-1.1.4-0.90.1.legacy.i386.rpm
036a6ed3976f47e77fbb6585246547367da08cfd  9/gaim-1.1.4-0.90.1.legacy.src.rpm
5db7c62375cf32712770d93772a81914c0c13da7  1/gaim-1.1.4-1.FC1.1.legacy.i386.rpm
6a1bef63f68e7651830b5add3e07df5235d64457  1/gaim-1.1.4-1.FC1.1.legacy.src.rpm

http://www.infostrategique.com/linuxrpms/legacy/7.3/gaim-1.1.4-0.73.1.legacy.i386.rpm
http://www.infostrategique.com/linuxrpms/legacy/7.3/gaim-1.1.4-0.73.1.legacy.src.rpm
http://www.infostrategique.com/linuxrpms/legacy/9/gaim-1.1.4-0.90.1.legacy.i386.rpm
http://www.infostrategique.com/linuxrpms/legacy/9/gaim-1.1.4-0.90.1.legacy.src.rpm
http://www.infostrategique.com/linuxrpms/legacy/1/gaim-1.1.4-1.FC1.1.legacy.i386.rpm
http://www.infostrategique.com/linuxrpms/legacy/1/gaim-1.1.4-1.FC1.1.legacy.src.rpm


-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.6 (GNU/Linux)

iD8DBQFCMRsMLMAs/0C4zNoRAlznAJ4srI3SU6VSetqwEPA0M2OfNTi1rwCguHMq
sP/GMz+lNowN0X8QcryzOCU=
=/EQt
-----END PGP SIGNATURE-----




------- Additional Comments From pekkas 2005-03-18 06:16:26 ----

Hmm.. I guess gaim is one of those packages which is worth updating instead of
backporting. Will QA..



------- Additional Comments From pekkas 2005-03-18 09:11:35 ----

I looked at this a bit.  It's very difficult to do QA RHL9/FC1, because there
have been so many changes in the spec file :-/.  Did you consider doing the same
as with RHL73, just upgraded to the latest and add the patches, but keep the
spec file changes to the minimum ?



------- Additional Comments From marcdeslauriers 2005-03-18 13:35:56 ----

Yeah, I considered it, but rh73 is easier to upgrade the version as it uses the
default gaim configuration, where rh9 and fc1 use a custom config that needs to
be changed every time.

for rh9 and fc1, it's easier to follow the rhel package.



------- Additional Comments From pekkas 2005-03-18 22:49:41 ----

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

QA w/ rpm-build-compare.sh:
 - source file integrity OK
 - patches verified
 - checked RHL9 and FC1 binaries w/ rpm-build-compare
 - spec file changes look cursorily OK; I don't use gaim, however.

A few notes:
   
- - In RHL9, there were some changes in gaim-fedora-prefs.xml, e.g., removing a
section with jabber.  Was this intentional? (I have no idea whether this
matters or not, because I don't use gaim..)

- - gaim 1.0.2 which we shipped for RHL9 included the following Requires which
are now missing: libcrypt.so.1, libgnome, libutil.so.1, mozilla-nss. 
perl.so is no longer provided either. This smells like trouble, especially
the lack of libcrypt.

I could give all of these a PUBLISH, but I'd hope someone who actually uses
gaim would double-check the above two issues first.

(+PUBLISH RHL73,RHL9,FC1)

627859eb624e8c9b76b70cd4405b8fd4ac676cde  gaim-1.1.4-0.73.1.legacy.src.rpm
036a6ed3976f47e77fbb6585246547367da08cfd  gaim-1.1.4-0.90.1.legacy.src.rpm
6a1bef63f68e7651830b5add3e07df5235d64457  gaim-1.1.4-1.FC1.1.legacy.src.rpm
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.0.7 (GNU/Linux)

iD8DBQFCO+eSGHbTkzxSL7QRAv6zAKCPNVXj98eDiMakD93OuwNgxlLO8QCfT6u/
VQ/TGefy8COpvzvGCTGlJS8=
=gUNd
-----END PGP SIGNATURE-----




------- Bug moved to this database by dkl 2005-03-30 18:31 -------

This bug previously known as bug 2447 at https://bugzilla.fedora.us/
https://bugzilla.fedora.us/show_bug.cgi?id=2447
Originally filed under the Fedora Legacy product and Package request component.

Unknown priority P2. Setting to default priority "normal".
Unknown platform PC. Setting to default platform "All".
Setting qa contact to the default for this product.
   This bug either had no qa contact or an invalid one.