Please update pidgin to fix security vulnerabilities

[Nicola Ferralis]

Pidgin in generic hardy has been update to fix three security vulnerabilities. The patches should be applied to tpidgin for the mini. Note that pidgin for the mini is in version 1:2.4.3ubuntu1~hardy1netbook5.

pidgin (1:2.4.1-1ubuntu2.4) hardy-security; urgency=low

  * SECURITY UPDATE: denial of service or possible code execution in XMPP
    file transfer
    - debian/patches/81_security_CVE-2009-1373.patch: calculate lengths
      correctly in libpurple/protocols/jabber/si.c.
    - CVE-2009-1373
  * SECURITY UPDATE: denial of service in PurpleCircBuffer object expansion
    - debian/patches/82_security_CVE-2009-1375.patch: add an additional
      check in libpurple/circbuffer.c.
    - CVE-2009-1375
  * SECURITY UPDATE: arbitrary code execution via crafted MSN message
    - debian/patches/83_security_CVE-2009-1376.patch: switch offset
      variable to guint64 in libpurple/protocols/msn/slplink.c.
    - CVE-2009-1376

 -- Marc Deslauriers <email address hidden> Mon, 25 May 2009 17:24:40 +0200

[Nicola Ferralis (feranick)]

New security vulnerabilities in current version. Generic hardy already patched to version 1:2.4.1-1ubuntu2.6. The same patch should be applied ASAP to the mini.

CVE-2009-2694

[Endrew (endrew)]

No patch has been released since the last answer....Hellooooo?!?!?!
What's going on there? I'm waiting for the patch too.

Why can't the Mini users get a well supported distro for their money as the other users get for free for the official Hardy???

[Nicola Ferralis (feranick)]

It's not a solution, but it allows you to have a fully updated pidgin in the mini, without having to wait for the official, but never coming patch.

https://launchpad.net/~pidgin-developers/+archive/ppa

> Date: Sun, 13 Dec 2009 07:42:00 +0000
> From: <email address hidden>
> To: <email address hidden>
> Subject: [Bug 383335] Re: Please update pidgin to fix security vulnerabilities
>
> No patch has been released since the last answer....Hellooooo?!?!?!
> What's going on there? I'm waiting for the patch too.
>
> Why can't the Mini users get a well supported distro for their money as
> the other users get for free for the official Hardy???
>
> --
> Please update pidgin to fix security vulnerabilities
> https://bugs.launchpad.net/bugs/383335
> You received this bug notification because you are a direct subscriber
> of the bug.

_________________________________________________________________
Hotmail: Powerful Free email with security by Microsoft.
http://clk.atdmt.com/GBL/go/171222986/direct/01/

[Endrew (endrew)]

Thanks for the information.

Is there any official way of complaining about the quality of this Belmont? I have still the feeling that i do not get a proper up-to-date system without security holes for my money.