Pidgin is an instant messaging program which can log in to multiple accounts on multiple instant messaging networks simultaneously. A flaw was found in the way the Pidgin MSN protocol plug-in processed text that was not encoded in UTF-8. A remote attacker could use this flaw to crash Pidgin by sending a specially-crafted MSN message. (CVE-2012-1178) An input validation flaw was found in the way the Pidgin MSN protocol plug-in handled MSN notification messages. A malicious server or a remote attacker could use this flaw to crash Pidgin by sending a specially-crafted MSN notification message. (CVE-2012-2318) A buffer overflow flaw was found in the Pidgin MXit protocol plug-in. A remote attacker could use this flaw to crash Pidgin by sending a MXit message containing specially-crafted emoticon tags. (CVE-2012-3374) Red Hat would like to thank the Pidgin project for reporting the CVE-2012-3374 issue. Upstream acknowledges Ulf HΒ€rnhammar as the original reporter of CVE-2012-3374. All Pidgin users should upgrade to these updated packages, which contain backported patches to resolve these issues. Pidgin must be restarted for this update to take effect.
hg.pidgin.im/pidgin/main/rev/4d6bcb4f4ea4
pidgin.im/news/security/?id=63
rhn.redhat.com/errata/RHSA-2012-1102.html
secunia.com/advisories/50005
www.mandriva.com/security/advisories?name=MDVSA-2012:082
www.securityfocus.com/bid/53400
access.redhat.com/security/updates/classification/#moderate
hermes.opensuse.org/messages/15136503
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A17448
rhn.redhat.com/errata/RHSA-2012-1102.html