Bug 683031 (CVE-2011-1091) - CVE-2011-1091 Pidgin: Multiple NULL pointer dereference flaws in Yahoo protocol plug-in
Summary: CVE-2011-1091 Pidgin: Multiple NULL pointer dereference flaws in Yahoo protoc...
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2011-1091
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
low
low
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard: public=20110310,reported=20110305,sou...
Depends On: 684119 684120 743796 743797 743798 833968
Blocks: 743482
TreeView+ depends on / blocked
 
Reported: 2011-03-08 11:52 UTC by Jan Lieskovsky
Modified: 2019-06-08 18:46 UTC (History)
4 users (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2015-08-22 15:55:32 UTC


Attachments (Terms of Use)


Links
System ID Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2011:0616 normal SHIPPED_LIVE Low: pidgin security and bug fix update 2011-05-19 11:09:02 UTC
Red Hat Product Errata RHSA-2011:1371 normal SHIPPED_LIVE Moderate: pidgin security update 2011-10-14 03:31:26 UTC

Description Jan Lieskovsky 2011-03-08 11:52:52 UTC
Multiple NULL pointer dereference flaws were found in the way Yahoo protocol
plug-in of the Pidgin instant messaging client handled malformed YMSG packets
(SMS messages and notification packets). A remote, authenticated user could
use this flaw to cause denial of service (Pidgin crash) via specially-crafted
notification message. The SMS messages handling issue is exploitable only via
specially-crafted SMS message, sent from remote, malicious Yahoo server.

Acknowledgements:

Red Hat would like to thank the Pidgin project for reporting these issues.
Upstream acknowledges Marius Wachtler as the original reporter.

Comment 3 Jan Lieskovsky 2011-03-08 12:03:53 UTC
This issue affects the versions of the pidgin package, as shipped
with Red Hat Enterprise Linux 4, 5, and 6.

--

This issue affects the versions of the pidgin package, as shipped
with Fedora release of 13 and 14.

Comment 5 Jan Lieskovsky 2011-03-08 12:33:00 UTC
The CVE identifier of CVE-2011-1091 has been assigned to these issues.

Comment 11 Huzaifa S. Sidhpurwala 2011-03-11 07:24:46 UTC
public via:

http://pidgin.im/news/security/?id=51

Comment 13 Huzaifa S. Sidhpurwala 2011-03-11 07:27:38 UTC
Created pidgin tracking bugs for this issue

Affects: fedora-all [bug 684120]

Comment 14 Huzaifa S. Sidhpurwala 2011-03-11 07:42:13 UTC
Statement:

This issue affects the versions of pidgin package as shipped with Red Hat Enterprise Linux 4, 5 and 6. The Red Hat Security Response Team has rated this issue as having low security impact, a future update may address this flaw.

Comment 17 errata-xmlrpc 2011-05-19 11:09:09 UTC
This issue has been addressed in following products:

  Red Hat Enterprise Linux 6

Via RHSA-2011:0616 https://rhn.redhat.com/errata/RHSA-2011-0616.html

Comment 18 errata-xmlrpc 2011-05-19 13:41:13 UTC
This issue has been addressed in following products:

  Red Hat Enterprise Linux 6

Via RHSA-2011:0616 https://rhn.redhat.com/errata/RHSA-2011-0616.html

Comment 20 errata-xmlrpc 2011-10-14 03:31:33 UTC
This issue has been addressed in following products:

  Red Hat Enterprise Linux 4
  Red Hat Enterprise Linux 5

Via RHSA-2011:1371 https://rhn.redhat.com/errata/RHSA-2011-1371.html


Note You need to log in before you can comment on or make changes to this bug.