CVE-2011-4922
Published: 4 January 2012
cipher.c in the Cipher API in libpurple in Pidgin before 2.7.10 retains encryption-key data in process memory, which might allow local users to obtain sensitive information by reading a core file or other representation of memory contents. It was discovered that libpurple versions prior to 2.7.10 do not properly clear certain data structures used in libpurple/cipher.c prior to freeing. An attacker could potentially extract partial information from memory regions freed by libpurple.
Priority
Status
| Package | Release | Status |
|---|---|---|
|
pidgin
Launchpad, Ubuntu, Debian |
hardy |
Ignored
(end of life)
|
| lucid |
Released
(1:2.6.6-1ubuntu4.5)
|
|
| maverick |
Ignored
(end of life)
|
|
| natty |
Not vulnerable
(1:2.7.11-1ubuntu2.1)
|
|
| oneiric |
Not vulnerable
(1:2.10.0-0ubuntu2)
|
|
| precise |
Not vulnerable
(1:2.10.1-1ubuntu1)
|
|
| upstream |
Released
(2.7.10-1)
|
|
|
Patches:
upstream: http://hg.pidgin.im/pidgin/main/rev/8c850977cb42 |
||