openSUSE Security Update: Security update for pidgin
______________________________________________________________________________

Announcement ID:    openSUSE-SU-2017:0973-1
Rating:             important
References:         #1009974 #1028835 
Cross-References:   CVE-2017-2640
Affected Products:
                    openSUSE Leap 42.2
______________________________________________________________________________

   An update that solves one vulnerability and has one errata
   is now available.

Description:


   This update for pidgin to version 2.12.0 fixes the following issues:

   This security issue was fixed:
   - CVE-2017-2640: Out of bounds memory read in
     purple_markup_unescape_entity (boo#1028835).

   These non-security issues were fixed:
   + libpurple:
     - Fix the use of uninitialised memory if running non-debug-enabled
       versions of glib.
     - Update AIM dev and dist ID's to new ones that were assigned by AOL.
     - TLS certificate verification now uses SHA-256 checksums.
     - Fix the SASL external auth for Freenode (boo#1009974).
     - Remove the MSN protocol plugin. It has been unusable and dormant for
       some time.
     - Remove the Mxit protocol plugin. The service was closed at the end
       ofSeptember 2016.
     - Remove the MySpaceIM protocol plugin. The service has been defunct for
       a long time (pidgin.im#15356).
     - Remove the Yahoo! protocol plugin. Yahoo has completely reimplemented
       their protocol, so this version is no longer
       operable as of August 5th, 2016.
     - Remove the Facebook (XMPP) account option. According to
       https://developers.facebook.com/docs/chat the XMPP Chat API service
       ended April 30th, 2015.
     - Fix gnutls certificate validation errors that mainly affected Google.
   + General:
     - Replace instances of d.pidgin.im with developer.pidgin.im and update
       the urls to use https (pidgin.im#17036).
   + IRC:
     - Fix an issue of messages being silently cut off at 500 characters.
       Large messages are now split into parts and sent
       one by one (pidgin.im#4753).


Patch Instructions:

   To install this openSUSE Security Update use YaST online_update.
   Alternatively you can run the command listed for your product:

   - openSUSE Leap 42.2:

      zypper in -t patch openSUSE-2017-457=1

   To bring your system up-to-date, use "zypper patch".


Package List:

   - openSUSE Leap 42.2 (noarch):

      libpurple-branding-openSUSE-42.2-3.3.2
      libpurple-branding-upstream-2.12.0-8.6.1
      libpurple-lang-2.12.0-8.6.1

   - openSUSE Leap 42.2 (x86_64):

      finch-2.12.0-8.6.1
      finch-debuginfo-2.12.0-8.6.1
      finch-devel-2.12.0-8.6.1
      libpurple-2.12.0-8.6.1
      libpurple-debuginfo-2.12.0-8.6.1
      libpurple-devel-2.12.0-8.6.1
      libpurple-plugin-sametime-2.12.0-8.6.1
      libpurple-plugin-sametime-debuginfo-2.12.0-8.6.1
      libpurple-tcl-2.12.0-8.6.1
      libpurple-tcl-debuginfo-2.12.0-8.6.1
      pidgin-2.12.0-8.6.1
      pidgin-debuginfo-2.12.0-8.6.1
      pidgin-debugsource-2.12.0-8.6.1
      pidgin-devel-2.12.0-8.6.1


References:

   https://www.suse.com/security/cve/CVE-2017-2640.html
   https://bugzilla.suse.com/1009974
   https://bugzilla.suse.com/1028835

-- 
To unsubscribe, e-mail: opensuse-security-announce+unsubscribe@opensuse.org
For additional commands, e-mail: opensuse-security-announce+help@opensuse.org