Hi, On 14 Jan 2015, at 08:21, Thijs Alkemade <m...@thijsalkema.de> wrote: >> On 14 jan. 2015, at 00:29, Felix Dreissig <f...@f30.me> wrote: >> >> Hi, >> >> on 22 October 2014, Pidgin 2.10.10 was released, fixing several security >> vulnerabilities. One of those is a arbitrary memory read via XMPP >> (CVE-2014-3698). I can see no indication that Adium might not be vulnerable >> to these issues. > > The vulnerability only applies when libpurple is built with libidn support, > which Adium 1.5 isn’t.
Glad to hear that. This also leaves me less confused, since you are attributed as one of the issue’s discoverers as well. Of to other security issues fixed in Pidgin 2.10.10, one other looks specific to Pidgin too (CVE-2014-3694), one only affects Windows (CVE-2014-3697) and one concerns the MXit protocol, which currently doesn’t seem to be supported by Adium (CVE-2014-3695). Which leaves CVE-2014-3696 – can you tell anything about that in regard to Adium? Although GroupWise is presumably used much less than XMPP and it looks like „just“ a DoS without an option to anything more, it would still be an outstanding security issue. Regards, Felix
signature.asc
Description: Message signed with OpenPGP using GPGMail
