===========================================================
Ubuntu Security Notice USN-820-1 August 20, 2009
pidgin vulnerability
CVE-2009-2694
===========================================================
A security issue affects the following Ubuntu releases:
Ubuntu 8.04 LTS
Ubuntu 8.10
Ubuntu 9.04
This advisory also applies to the corresponding versions of
Kubuntu, Edubuntu, and Xubuntu.
The problem can be corrected by upgrading your system to the
following package versions:
Ubuntu 8.04 LTS:
pidgin 1:2.4.1-1ubuntu2.6
Ubuntu 8.10:
pidgin 1:2.5.2-0ubuntu1.4
Ubuntu 9.04:
pidgin 1:2.5.5-1ubuntu8.4
After a standard system upgrade you need to restart Pidgin to effect the
necessary changes.
Details follow:
Federico Muttis discovered that Pidgin did not properly handle certain
malformed messages in the MSN protocol handler. A remote attacker could
send a specially crafted message and possibly execute arbitrary code with
user privileges.
Updated packages for Ubuntu 8.04 LTS:
Source archives:
http://security.ubuntu.com/ubuntu/pool/main/p/pidgin/pidgin_2.4.1-1ubuntu2.6.diff.gz
Size/MD5: 69507 5a156d0c5aae91c4518d86911159959c
http://security.ubuntu.com/ubuntu/pool/main/p/pidgin/pidgin_2.4.1-1ubuntu2.6.dsc
Size/MD5: 1539 1104a50f69066f066c7b8bf0a92ce9fe
http://security.ubuntu.com/ubuntu/pool/main/p/pidgin/pidgin_2.4.1.orig.tar.gz
Size/MD5: 13297380 25e3593d5e6bfc17911111475a057778
Architecture independent packages:
http://security.ubuntu.com/ubuntu/pool/main/p/pidgin/finch-dev_2.4.1-1ubuntu2.6_all.deb
Size/MD5: 37842 ec50ba9bcce0dd5a810a777465c20074
http://security.ubuntu.com/ubuntu/pool/main/p/pidgin/libpurple-bin_2.4.1-1ubuntu2.6_all.deb
Size/MD5: 92552 ef9f734ad6866526d51e6f407fdba966
http://security.ubuntu.com/ubuntu/pool/main/p/pidgin/libpurple-dev_2.4.1-1ubuntu2.6_all.deb
Size/MD5: 234660 c4dfe36cdbefecb8bf441a8567a52108
http://security.ubuntu.com/ubuntu/pool/main/p/pidgin/pidgin-data_2.4.1-1ubuntu2.6_all.deb
Size/MD5: 1329166 d91a4934ea28ab1e64120e438525448e
http://security.ubuntu.com/ubuntu/pool/main/p/pidgin/pidgin-dev_2.4.1-1ubuntu2.6_all.deb
Size/MD5: 72640 6b052c77f6dfb7b8e0bbffc8ecd1ab84
http://security.ubuntu.com/ubuntu/pool/universe/p/pidgin/gaim_2.4.1-1ubuntu2.6_all.deb
Size/MD5: 86694 5a0eaf4be7a773d8a7ed686042a02e7d
amd64 architecture (Athlon64, Opteron, EM64T Xeon):
http://security.ubuntu.com/ubuntu/pool/main/p/pidgin/finch_2.4.1-1ubuntu2.6_amd64.deb
Size/MD5: 226878 53aacddff6bc8d1966f7a7b81432f592
http://security.ubuntu.com/ubuntu/pool/main/p/pidgin/libpurple0_2.4.1-1ubuntu2.6_amd64.deb
Size/MD5: 1604958 9875aa3a72e74708ed0f94f575004814
http://security.ubuntu.com/ubuntu/pool/main/p/pidgin/pidgin-dbg_2.4.1-1ubuntu2.6_amd64.deb
Size/MD5: 4433000 30e0125a11a4c887d534849349a645c7
http://security.ubuntu.com/ubuntu/pool/main/p/pidgin/pidgin_2.4.1-1ubuntu2.6_amd64.deb
Size/MD5: 572086 5348b7a095d38250f3cd3c31c32e491d
i386 architecture (x86 compatible Intel/AMD):
http://security.ubuntu.com/ubuntu/pool/main/p/pidgin/finch_2.4.1-1ubuntu2.6_i386.deb
Size/MD5: 200868 b153c8e53681be3fd3e3eb41fdb82c1d
http://security.ubuntu.com/ubuntu/pool/main/p/pidgin/libpurple0_2.4.1-1ubuntu2.6_i386.deb
Size/MD5: 1365242 934661f4c2232b2d1826b64a1cc4f659
http://security.ubuntu.com/ubuntu/pool/main/p/pidgin/pidgin-dbg_2.4.1-1ubuntu2.6_i386.deb
Size/MD5: 4242684 c6e5f637467ff8f3dba27eb19fcf1da5
http://security.ubuntu.com/ubuntu/pool/main/p/pidgin/pidgin_2.4.1-1ubuntu2.6_i386.deb
Size/MD5: 517148 f76f50f194cb75c1a8f35bdd1a576704
lpia architecture (Low Power Intel Architecture):
http://ports.ubuntu.com/pool/main/p/pidgin/finch_2.4.1-1ubuntu2.6_lpia.deb
Size/MD5: 197204 217c1b7f8b880f0e51cf48576c832d3d
http://ports.ubuntu.com/pool/main/p/pidgin/libpurple0_2.4.1-1ubuntu2.6_lpia.deb
Size/MD5: 1415524 cd7ed00e6a5b13263276525f8e903f86
http://ports.ubuntu.com/pool/main/p/pidgin/pidgin-dbg_2.4.1-1ubuntu2.6_lpia.deb
Size/MD5: 4372818 60ef38a0d87eea5e5da43bfeaf3f442a
http://ports.ubuntu.com/pool/main/p/pidgin/pidgin_2.4.1-1ubuntu2.6_lpia.deb
Size/MD5: 511658 8e064b636314cd8e6ce25ed0ac67b12c
powerpc architecture (Apple Macintosh G3/G4/G5):
http://ports.ubuntu.com/pool/main/p/pidgin/finch_2.4.1-1ubuntu2.6_powerpc.deb
Size/MD5: 237196 517b05a34a8d51bbc566971d29d324aa
http://ports.ubuntu.com/pool/main/p/pidgin/libpurple0_2.4.1-1ubuntu2.6_powerpc.deb
Size/MD5: 1633794 df2f3495ac7574b822a29c588f5a8039
http://ports.ubuntu.com/pool/main/p/pidgin/pidgin-dbg_2.4.1-1ubuntu2.6_powerpc.deb
Size/MD5: 4475988 cebbe3d44501c5aa2d2b01aae0994f71
http://ports.ubuntu.com/pool/main/p/pidgin/pidgin_2.4.1-1ubuntu2.6_powerpc.deb
Size/MD5: 589664 458348c9b4fb1c2e83518c7c2a1c53f9
sparc architecture (Sun SPARC/UltraSPARC):
http://ports.ubuntu.com/pool/main/p/pidgin/finch_2.4.1-1ubuntu2.6_sparc.deb
Size/MD5: 212842 f78bd158351aa2ca3343a4b6063ed174
http://ports.ubuntu.com/pool/main/p/pidgin/libpurple0_2.4.1-1ubuntu2.6_sparc.deb
Size/MD5: 1532072 f4dfba9cc441bdfaaa2fd37c524a3810
http://ports.ubuntu.com/pool/main/p/pidgin/pidgin-dbg_2.4.1-1ubuntu2.6_sparc.deb
Size/MD5: 4364276 e864905da92a2241ba84d5255ce2fad9
http://ports.ubuntu.com/pool/main/p/pidgin/pidgin_2.4.1-1ubuntu2.6_sparc.deb
Size/MD5: 545638 606651780f94920ef040d7743ea8bc5e
Updated packages for Ubuntu 8.10:
Source archives:
http://security.ubuntu.com/ubuntu/pool/main/p/pidgin/pidgin_2.5.2-0ubuntu1.4.diff.gz
Size/MD5: 61560 58944be4aa28de054908df79369620c2
http://security.ubuntu.com/ubuntu/pool/main/p/pidgin/pidgin_2.5.2-0ubuntu1.4.dsc
Size/MD5: 1995 5658c94d3bc24be6b83a9124900bb7a0
http://security.ubuntu.com/ubuntu/pool/main/p/pidgin/pidgin_2.5.2.orig.tar.gz
Size/MD5: 11642659 3ad83133a2381087cbdddf42ba5d6ecf
Architecture independent packages:
http://security.ubuntu.com/ubuntu/pool/main/p/pidgin/finch-dev_2.5.2-0ubuntu1.4_all.deb
Size/MD5: 38224 cbd002bb11c2f248593ac61bad571401
http://security.ubuntu.com/ubuntu/pool/main/p/pidgin/libpurple-bin_2.5.2-0ubuntu1.4_all.deb
Size/MD5: 95074 2838319e1abfc1b8a24b97079ceaf354
http://security.ubuntu.com/ubuntu/pool/main/p/pidgin/libpurple-dev_2.5.2-0ubuntu1.4_all.deb
Size/MD5: 242534 c9a8326b0ce821c0d2b6794832b521d1
http://security.ubuntu.com/ubuntu/pool/main/p/pidgin/pidgin-data_2.5.2-0ubuntu1.4_all.deb
Size/MD5: 1107062 51ae15cbd685cb3744b7fc5434690363
http://security.ubuntu.com/ubuntu/pool/main/p/pidgin/pidgin-dev_2.5.2-0ubuntu1.4_all.deb
Size/MD5: 1357218 c642982c4ff1dddbe103ba93a00a447c
amd64 architecture (Athlon64, Opteron, EM64T Xeon):
http://security.ubuntu.com/ubuntu/pool/main/p/pidgin/finch_2.5.2-0ubuntu1.4_amd64.deb
Size/MD5: 230064 3677b51d87081df77939ddc31684395c
http://security.ubuntu.com/ubuntu/pool/main/p/pidgin/libpurple0_2.5.2-0ubuntu1.4_amd64.deb
Size/MD5: 1754926 6edd00a26a1a040e68cd2af319f7d233
http://security.ubuntu.com/ubuntu/pool/main/p/pidgin/pidgin-dbg_2.5.2-0ubuntu1.4_amd64.deb
Size/MD5: 4660668 9e2a3d93cac27c1fac9272694978a098
http://security.ubuntu.com/ubuntu/pool/main/p/pidgin/pidgin_2.5.2-0ubuntu1.4_amd64.deb
Size/MD5: 613972 a0afaa6578e710bcca694847becd6db2
i386 architecture (x86 compatible Intel/AMD):
http://security.ubuntu.com/ubuntu/pool/main/p/pidgin/finch_2.5.2-0ubuntu1.4_i386.deb
Size/MD5: 204018 89c9e0700ec1d8641a9d77618b8fb580
http://security.ubuntu.com/ubuntu/pool/main/p/pidgin/libpurple0_2.5.2-0ubuntu1.4_i386.deb
Size/MD5: 1503386 4cba742a8fcb81c157abf326da8e67b6
http://security.ubuntu.com/ubuntu/pool/main/p/pidgin/pidgin-dbg_2.5.2-0ubuntu1.4_i386.deb
Size/MD5: 4464550 af50a31b8cdc1b3e48d732ec7ed2730c
http://security.ubuntu.com/ubuntu/pool/main/p/pidgin/pidgin_2.5.2-0ubuntu1.4_i386.deb
Size/MD5: 559602 4f6ad7167e636c485ebbb29d1c14c9f9
lpia architecture (Low Power Intel Architecture):
http://ports.ubuntu.com/pool/main/p/pidgin/finch_2.5.2-0ubuntu1.4_lpia.deb
Size/MD5: 200652 0eaa53bfcf1d9bb24e946ff8a8b7a28a
http://ports.ubuntu.com/pool/main/p/pidgin/libpurple0_2.5.2-0ubuntu1.4_lpia.deb
Size/MD5: 1552332 f58dd6dd3aee3a742f2fec7ba89f5fc4
http://ports.ubuntu.com/pool/main/p/pidgin/pidgin-dbg_2.5.2-0ubuntu1.4_lpia.deb
Size/MD5: 4599368 8925851f4ea5e84099e933eb8c5fdd96
http://ports.ubuntu.com/pool/main/p/pidgin/pidgin_2.5.2-0ubuntu1.4_lpia.deb
Size/MD5: 553780 e360880cb932c6de68ba7eb316278997
powerpc architecture (Apple Macintosh G3/G4/G5):
http://ports.ubuntu.com/pool/main/p/pidgin/finch_2.5.2-0ubuntu1.4_powerpc.deb
Size/MD5: 235494 4ebe061587c4872395aaf64622cbd2db
http://ports.ubuntu.com/pool/main/p/pidgin/libpurple0_2.5.2-0ubuntu1.4_powerpc.deb
Size/MD5: 1790572 c25454e4ced3fa17b3e802d814fb7e8d
http://ports.ubuntu.com/pool/main/p/pidgin/pidgin-dbg_2.5.2-0ubuntu1.4_powerpc.deb
Size/MD5: 4685030 a5783898cb1f912c3663b951c5e31af4
http://ports.ubuntu.com/pool/main/p/pidgin/pidgin_2.5.2-0ubuntu1.4_powerpc.deb
Size/MD5: 619564 932a0246c9e18aa2b0cab3cb3a9e4594
sparc architecture (Sun SPARC/UltraSPARC):
http://ports.ubuntu.com/pool/main/p/pidgin/finch_2.5.2-0ubuntu1.4_sparc.deb
Size/MD5: 217320 72184bf658167caeb2bc47452d09c8f2
http://ports.ubuntu.com/pool/main/p/pidgin/libpurple0_2.5.2-0ubuntu1.4_sparc.deb
Size/MD5: 1682764 f9bffdef0fb16d3f496ab1627651ff21
http://ports.ubuntu.com/pool/main/p/pidgin/pidgin-dbg_2.5.2-0ubuntu1.4_sparc.deb
Size/MD5: 4586964 d8db6242a8babf124ff7e6934ca6efa9
http://ports.ubuntu.com/pool/main/p/pidgin/pidgin_2.5.2-0ubuntu1.4_sparc.deb
Size/MD5: 590740 ea7404d3163fc59ec8c8261799cc475a
Updated packages for Ubuntu 9.04:
Source archives:
http://security.ubuntu.com/ubuntu/pool/main/p/pidgin/pidgin_2.5.5-1ubuntu8.4.diff.gz
Size/MD5: 132943 aa604b423d3e0da11231c0d7a83dcf0a
http://security.ubuntu.com/ubuntu/pool/main/p/pidgin/pidgin_2.5.5-1ubuntu8.4.dsc
Size/MD5: 1935 c608dd6c53dad7f0275a2ad1028564b9
http://security.ubuntu.com/ubuntu/pool/main/p/pidgin/pidgin_2.5.5.orig.tar.gz
Size/MD5: 11989031 08d9c0c8dd43dbcec6f67d8ba596029f
Architecture independent packages:
http://security.ubuntu.com/ubuntu/pool/main/p/pidgin/finch-dev_2.5.5-1ubuntu8.4_all.deb
Size/MD5: 38436 18056d63fcb05bb8b6d17154bcaeb84d
http://security.ubuntu.com/ubuntu/pool/main/p/pidgin/libpurple-bin_2.5.5-1ubuntu8.4_all.deb
Size/MD5: 97634 9e8cabec7e1f7b905023db61e62d1c64
http://security.ubuntu.com/ubuntu/pool/main/p/pidgin/libpurple-dev_2.5.5-1ubuntu8.4_all.deb
Size/MD5: 245702 27f6acf6074b062b54cbbd918adfccdb
http://security.ubuntu.com/ubuntu/pool/main/p/pidgin/pidgin-data_2.5.5-1ubuntu8.4_all.deb
Size/MD5: 1150970 245a7d841f315fd4f454cdf7db268805
http://security.ubuntu.com/ubuntu/pool/main/p/pidgin/pidgin-dev_2.5.5-1ubuntu8.4_all.deb
Size/MD5: 1371390 bc67528e9b401778a6f9f1e6247000c4
amd64 architecture (Athlon64, Opteron, EM64T Xeon):
http://security.ubuntu.com/ubuntu/pool/main/p/pidgin/finch_2.5.5-1ubuntu8.4_amd64.deb
Size/MD5: 235090 011807f7659fe732b5722381834bdd88
http://security.ubuntu.com/ubuntu/pool/main/p/pidgin/libpurple0_2.5.5-1ubuntu8.4_amd64.deb
Size/MD5: 1769468 f713610c9cbc32c475e80ae7dab67ae2
http://security.ubuntu.com/ubuntu/pool/main/p/pidgin/pidgin-dbg_2.5.5-1ubuntu8.4_amd64.deb
Size/MD5: 5845104 a2a5285fa38617b275c3aa8b041e879b
http://security.ubuntu.com/ubuntu/pool/main/p/pidgin/pidgin_2.5.5-1ubuntu8.4_amd64.deb
Size/MD5: 567412 924a52c9061cb147ca4823d24dacd292
i386 architecture (x86 compatible Intel/AMD):
http://security.ubuntu.com/ubuntu/pool/main/p/pidgin/finch_2.5.5-1ubuntu8.4_i386.deb
Size/MD5: 213590 2d54ff14bf96e073cfee100633e6bcf8
http://security.ubuntu.com/ubuntu/pool/main/p/pidgin/libpurple0_2.5.5-1ubuntu8.4_i386.deb
Size/MD5: 1552872 08b5cf06013b9a7ef1a572e69988698b
http://security.ubuntu.com/ubuntu/pool/main/p/pidgin/pidgin-dbg_2.5.5-1ubuntu8.4_i386.deb
Size/MD5: 5447526 75b0b2070a01d81c68418163c1533d0c
http://security.ubuntu.com/ubuntu/pool/main/p/pidgin/pidgin_2.5.5-1ubuntu8.4_i386.deb
Size/MD5: 519326 1a1788951a0f4994d562ef6b4aefc05c
lpia architecture (Low Power Intel Architecture):
http://ports.ubuntu.com/pool/main/p/pidgin/finch_2.5.5-1ubuntu8.4_lpia.deb
Size/MD5: 212134 4ba47ad65efe2d8ceff6e20142d60e78
http://ports.ubuntu.com/pool/main/p/pidgin/libpurple0_2.5.5-1ubuntu8.4_lpia.deb
Size/MD5: 1613190 41aca1287556ec81e70ae632a7a1c9c7
http://ports.ubuntu.com/pool/main/p/pidgin/pidgin-dbg_2.5.5-1ubuntu8.4_lpia.deb
Size/MD5: 5594584 9139deba520a05fc2647a1f382333376
http://ports.ubuntu.com/pool/main/p/pidgin/pidgin_2.5.5-1ubuntu8.4_lpia.deb
Size/MD5: 518514 c2d6cc567e03bca82bdecb693e5e3c57
powerpc architecture (Apple Macintosh G3/G4/G5):
http://ports.ubuntu.com/pool/main/p/pidgin/finch_2.5.5-1ubuntu8.4_powerpc.deb
Size/MD5: 245164 9ad3bfad1253d55f9b2222eee47092a0
http://ports.ubuntu.com/pool/main/p/pidgin/libpurple0_2.5.5-1ubuntu8.4_powerpc.deb
Size/MD5: 1825596 32e70c582368376d03f6cd929b47a711
http://ports.ubuntu.com/pool/main/p/pidgin/pidgin-dbg_2.5.5-1ubuntu8.4_powerpc.deb
Size/MD5: 5758858 3c515c7763d36dd644a2a0629d039104
http://ports.ubuntu.com/pool/main/p/pidgin/pidgin_2.5.5-1ubuntu8.4_powerpc.deb
Size/MD5: 580976 a9068c763728014f85fa73274c42bac5
Attachment:
signature.asc
Description: This is a digitally signed message part
