Pidgin 2.12.0 has been released on March 9, fixing a security issue: https://bitbucket.org/pidgin/www/src/tip/htdocs/ChangeLog?fileviewer=file-view-default It also fixed Freenode IRC authentication and a certificate validation error with Google that causes some users to not be able to connect (and others to not be able to stay connected). Protocols for dead services have been removed, and some for upstream protocols that changed have been moved to third-party plugins. It would be nice if we could package the new Yahoo! plugin.
Whiteboard: (none) => MGA5TOO
The package in Cauldron/v6 was already updated and I submitted an update to mga5 core/updates_testing.
Version: Cauldron => 5Whiteboard: MGA5TOO => (none)
Thanks! Any chance we can get that Yahoo! plugin packaged? Advisory: ======================== Updated pidgin packages fix security vulnerability: A server controlled by an attacker can send an invalid XML that can trigger an out-of-bound memory access. This might lead to a crash or, in some extreme cases, to remote code execution in the client-side (CVE-2017-2640). The pidgin package has been updated to version 2.12.0, which fixes this issue and other bugs, including certificate validation for the Google Talk protocol. It also removes protocol plugins for services that are no longer available or supported. See the upstream ChangeLog for details. References: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-2640 http://pidgin.im/news/security/?id=109 https://bitbucket.org/pidgin/www/src/tip/htdocs/ChangeLog?fileviewer=file-view-default https://www.debian.org/security/2017/dsa-3806 ======================== Updated packages in core/updates_testing: ======================== pidgin-2.12.0-1.mga5 pidgin-plugins-2.12.0-1.mga5 pidgin-perl-2.12.0-1.mga5 pidgin-tcl-2.12.0-1.mga5 pidgin-silc-2.12.0-1.mga5 libpurple-devel-2.12.0-1.mga5 libpurple0-2.12.0-1.mga5 libfinch0-2.12.0-1.mga5 finch-2.12.0-1.mga5 pidgin-bonjour-2.12.0-1.mga5 pidgin-meanwhile-2.12.0-1.mga5 pidgin-client-2.12.0-1.mga5 pidgin-i18n-2.12.0-1.mga5 from pidgin-2.12.0-1.mga5.src.rpm
CC: (none) => shlomifAssignee: shlomif => qa-bugs
CC: (none) => davidwhodginsWhiteboard: (none) => advisory
Testing under virtualbox is showing a regression. Before the update on an m5 i586 install, pidgin is working for irc. After the update it isn't, and on the modify account dialog, the drop down box for the protocol does not show any protocols to select from.
Whiteboard: advisory => advisory feedback
Dave, did you update all of the relevant packages?
That's embarrassing. Retested making sure I installed all of the updates, and it's working. Not sure what I missed before. Tested before and after installing the updates on both i586 and x86_64. Validating the update.
Keywords: (none) => validated_updateWhiteboard: advisory feedback => advisory MGA5-64-OK MGA5-32-OKCC: (none) => sysadmin-bugs
An update for this issue has been pushed to the Mageia Updates repository. http://advisories.mageia.org/MGASA-2017-0102.html
Status: NEW => RESOLVEDResolution: (none) => FIXED