<?xml version="1.0" encoding="UTF-8"?>
<!--PATCHINFO id="a886bdab004076b032a70da00a4ae29b"!-->
<update status="stable" from="maint-coord@suse.de" type="security" version="2032">
  <id>dbg111-finch</id>
  <title>pidgin: security update</title>
  <release>openSUSE 11.1</release>
  <issued date="1266593276"/>
  <references>
    <reference href="https://bugzilla.novell.com/show_bug.cgi?id=569616" id="569616" title="bug number 569616" type="bugzilla"/>
    <reference href="https://bugzilla.novell.com/show_bug.cgi?id=567799" id="567799" title="bug number 567799" type="bugzilla"/>
    <reference href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0277" id="CVE-2010-0277" title="CVE-2010-0277" type="cve"/>
    <reference href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0013" id="CVE-2010-0013" title="CVE-2010-0013" type="cve"/>
    <reference href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0420" id="CVE-2010-0420" title="CVE-2010-0420" type="cve"/>
    <reference href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0423" id="CVE-2010-0423" title="CVE-2010-0423" type="cve"/>
  </references>
  <description>This update of pidgin fixes various security vulnerabilities
- CVE-2010-0013: CVSS v2 Base Score: 4.3: Path Traversal
  (CWE-22) Remote file disclosure vulnerability by using
  the MSN protocol.
- CVE-2010-0277: CVSS v2 Base Score: 4.9: Resource
  Management Errors (CWE-399) MSN protocol plugin in
  libpurple allowed remote attackers to cause a denial of
  service (memory corruption) at least.
- CVE-2010-0420 Same nick names in XMPP MUC lead to a crash
  in finch.
- CVE-2010-0423 A remote denial of service attack (resource
  consumption) is possible by sending an IM with a lot of
  smilies in it.
</description>
  <pkglist>
    <collection>
        <package name="pidgin-debuginfo" arch="i586" version="2.6.6" release="0.1.2">
          <filename>pidgin-debuginfo-2.6.6-0.1.2.i586.rpm</filename>
        </package>
        <package name="pidgin-debuginfo" arch="ppc" version="2.6.6" release="0.1.2">
          <filename>pidgin-debuginfo-2.6.6-0.1.2.ppc.rpm</filename>
        </package>
        <package name="pidgin-debuginfo" arch="x86_64" version="2.6.6" release="0.1.2">
          <filename>pidgin-debuginfo-2.6.6-0.1.2.x86_64.rpm</filename>
        </package>
        <package name="pidgin-debugsource" arch="i586" version="2.6.6" release="0.1.2">
          <filename>pidgin-debugsource-2.6.6-0.1.2.i586.rpm</filename>
        </package>
        <package name="pidgin-debugsource" arch="ppc" version="2.6.6" release="0.1.2">
          <filename>pidgin-debugsource-2.6.6-0.1.2.ppc.rpm</filename>
        </package>
        <package name="pidgin-debugsource" arch="x86_64" version="2.6.6" release="0.1.2">
          <filename>pidgin-debugsource-2.6.6-0.1.2.x86_64.rpm</filename>
        </package>
    </collection>
  </pkglist>
</update>
