This is an OpenPGP/MIME signed message (RFC 4880 and 3156)
--===============1022041174823626770==
Content-Type: multipart/signed; micalg=pgp-sha512;
 protocol="application/pgp-signature";
 boundary="K4tucrJ9KGLa7WG67hCqWhRqNEswkHkvq"

This is an OpenPGP/MIME signed message (RFC 4880 and 3156)
--K4tucrJ9KGLa7WG67hCqWhRqNEswkHkvq
Content-Type: multipart/mixed;
 boundary="XvH8Ow6CHp8PO45il0fV8F6SQFGrCVRR1"
From: Marc Deslauriers <marc.deslauriers@canonical.com>
Reply-To: Ubuntu Security <security@ubuntu.com>
To: ubuntu-security-announce@lists.ubuntu.com
Message-ID: <2c2ac897-543d-b6ba-fcc4-c9aafb69c366@canonical.com>
Subject: [USN-3231-1] Pidgin vulnerability

--XvH8Ow6CHp8PO45il0fV8F6SQFGrCVRR1
Content-Type: text/plain; charset=utf-
Content-Transfer-Encoding: quoted-printable

==========================================================================
Ubuntu Security Notice USN-3231-1
March 14, 2017

pidgin vulnerability
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 14.04 LTS
- Ubuntu 12.04 LTS

Summary:

Pidgin could be made to crash or run programs if it received specially
crafted network traffic.

Software Description:
- pidgin: graphical multi-protocol instant messaging client for X

Details:

Joseph Bisch discovered that Pidgin incorrectly handled certain xml
messages. A remote attacker could use this issue to cause Pidgin to crash,
resulting in a denial of service, or possibly execute arbitrary code.

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 14.04 LTS:
  libpurple0                      1:2.10.9-0ubuntu3.4

Ubuntu 12.04 LTS:
  libpurple0                      1:2.10.3-0ubuntu1.8

After a standard system update you need to restart Pidgin to make all the
necessary changes.

References:
  http://www.ubuntu.com/usn/usn-3231-1
  CVE-2017-2640

Package Information:
  https://launchpad.net/ubuntu/+source/pidgin/1:2.10.9-0ubuntu3.4
  https://launchpad.net/ubuntu/+source/pidgin/1:2.10.3-0ubuntu1.8



--XvH8Ow6CHp8PO45il0fV8F6SQFGrCVRR1--

--K4tucrJ9KGLa7WG67hCqWhRqNEswkHkvq
Content-Type: application/pgp-signature; name="signature.asc"
Content-Description: OpenPGP digital signature
Content-Disposition: attachment; filename="signature.asc"

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2

iQIcBAEBCgAGBQJYx+GlAAoJEGVp2FWnRL6Tcp8QAJLeXDvU7dxAus+apZGAFG7O
jHuqnwfNMERp8vE/cwHg6GUOJFubSXWl4kduiovv2WYXVDx5agZztGNePzjCzwsb
JnThw4tpbMdbINEoHyrRtKG8DwJw52hytJwHkkpVkAFd79IE5sUNvHSrk09z/B6+
6E9nCt6d0xexWYgMD/y8E7X2yK67FE84UncnSuc834fSjMO8fqmh84wqQhpYampJ
b6D9Xl5nLQFpJGNcLEQT6ibJkgF4zTgN0ZVjZrKpEt+00yeFlzY+XS7wod6/Lr8m
R9kQnEqELNsxcfdB4RS/Bowr2lKq/3VUShp+b1vJEYHYOMTLwUQKaw+3P8jqSEHU
JVDyu0gxOtBiGc/C6EATTUB1svIZvG3VGeym4S8mk+YoG5C4XeZfklDclMpI3u3g
tVwNYHd/M4p0RYJxQ5NoaZDW1FSNA+LciGKrrbFGDIjdO+huGVaAZYM3q6/6KbEb
oRm+sxvPkJQ/aC1eK5RpvaLTziOuhOeGkxiB0B+XzmZ3Em3HOkktcXEILm8edHCJ
e9TyRTDYK16G8qHXd+8nPGJnyq/xYL5RTWTjDTFp5L66Axo3EvRylPrTmYHC3/4u
M3DRPaq9iJY9sXW135svAbJz1Aj6ldLhynwASpsVVHJbVvyn1I1AQFZ6DXOgpWTR
iNOaNbo+yvsNZmOKAupO
=oSj8
-----END PGP SIGNATURE-----

--K4tucrJ9KGLa7WG67hCqWhRqNEswkHkvq--


--===============1022041174823626770==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

-- 
ubuntu-security-announce mailing list
ubuntu-security-announce@lists.ubuntu.com
Modify settings or unsubscribe at: https://lists.ubuntu.com/mailman/listinfo/ubuntu-security-announce

--===============1022041174823626770==--