MGASA-2017-0102

See a problem?
Please try reporting it to the source first.
Source
https://advisories.mageia.org/MGASA-2017-0102.html
Import Source
https://advisories.mageia.org/MGASA-2017-0102.json
JSON Data
https://api.test.osv.dev/v1/vulns/MGASA-2017-0102
Related
Published
2017-04-04T06:44:05Z
Modified
2017-04-04T06:31:14Z
Summary
Updated pidgin packages fix security vulnerability
Details

A server controlled by an attacker can send an invalid XML that can trigger an out-of-bound memory access. This might lead to a crash or, in some extreme cases, to remote code execution in the client-side (CVE-2017-2640).

The pidgin package has been updated to version 2.12.0, which fixes this issue and other bugs, including certificate validation for the Google Talk protocol. It also removes protocol plugins for services that are no longer available or supported. See the upstream ChangeLog for details.

References
Credits

Affected packages

Mageia:5 / pidgin

Package

Name
pidgin
Purl
pkg:rpm/mageia/pidgin?distro=mageia-5

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
2.12.0-1.mga5

Ecosystem specific 

{
    "section": "core"
}