# HG changeset patch
# Node ID ac220d489c94
# Parent  b4241824a900
diff --git a/hugo/content/about/security/advisories/cve-2011-1091-00.md b/hugo/content/about/security/advisories/cve-2011-1091-00.md
new file mode 100644
--- /dev/null
+++ b/hugo/content/about/security/advisories/cve-2011-1091-00.md
@@ -0,0 +1,22 @@
+---
+title: cve-2011-1091-00
+date: 2011-03-10T00:00:00.000Z
+cveNumber: cve-2011-1091
+summary: Remote denial of service in Yahoo protocol plugin
+discoveredBy: Marius Wachtler
+fixedInRelease: 2.7.11
+type: security
+layout: cve
+hidden: true
+---
+
+### Description
+
+The Yahoo protocol plugin in libpurple versions 2.6.0 through 2.7.10 do not
+properly handle malformed YMSG packets, leading to NULL pointer dereferences and
+application crash.
+
+### Mitigation
+
+Properly handle malformed packets by ignoring the packet or the missing field.
+
diff --git a/hugo/content/about/security/advisories/cve-2011-2485-00.md b/hugo/content/about/security/advisories/cve-2011-2485-00.md
new file mode 100644
--- /dev/null
+++ b/hugo/content/about/security/advisories/cve-2011-2485-00.md
@@ -0,0 +1,27 @@
+---
+title: cve-2011-2485-00
+date: 2011-06-23T00:00:00.000Z
+cveNumber: cve-2011-2485
+summary: Remote denial of service from corrupt buddy icons
+discoveredBy: Mark Doliner
+fixedInRelease: 2.9.0
+type: security
+layout: cve
+hidden: true
+---
+
+### Description
+
+It was found that the gdk-pixbuf GIF image loader routine
+`gdk_pixbuf__gif_image_load()` did not properly handle certain return values
+from its subroutines. A remote attacker could provide a specially-crafted GIF
+image, which, once opened in Pidgin, would lead gdk-pixbuf to return a partially
+initialized pixbuf structure. Using this structure, possibly containing a huge
+width and height, could lead to the application being terminated due to
+excessive memory use.
+
+### Mitigation
+
+Change Pidgin to look at the GError parameter in addition to the return value
+when calling certain gdk-pixbuf functions.
+
diff --git a/hugo/content/about/security/advisories/cve-2011-2943-00.md b/hugo/content/about/security/advisories/cve-2011-2943-00.md
new file mode 100644
--- /dev/null
+++ b/hugo/content/about/security/advisories/cve-2011-2943-00.md
@@ -0,0 +1,24 @@
+---
+title: cve-2011-2943-00
+date: 2011-08-20T00:00:00.000Z
+cveNumber: cve-2011-2943
+summary: Remote crash in IRC protocol plugin
+discoveredBy: Djego Ibanez, Lead QA at Gamistry
+fixedInRelease: 2.10.0
+type: security
+layout: cve
+hidden: true
+---
+
+### Description
+
+Certain characters in the nicknames of IRC users can trigger a null pointer
+dereference in the IRC protocol plugin's handling of responses to WHO requests.
+This can cause a crash on some operating systems. Clients based on libpurple
+2.8.0 through 2.9.0 are affected.
+
+### Mitigation
+
+Change libpurple to validate the data it receives from the server before
+attempting to use it.
+
diff --git a/hugo/content/about/security/advisories/cve-2011-3184-00.md b/hugo/content/about/security/advisories/cve-2011-3184-00.md
new file mode 100644
--- /dev/null
+++ b/hugo/content/about/security/advisories/cve-2011-3184-00.md
@@ -0,0 +1,26 @@
+---
+title: cve-2011-3184-00
+date: 2011-08-20T00:00:00.000Z
+cveNumber: cve-2011-3184
+summary: Remote crash in MSN protocol plugin
+discoveredBy: Marius Wachtler
+fixedInRelease: 2.10.0
+type: security
+layout: cve
+hidden: true
+---
+
+### Description
+
+Incorrect handling of HTTP 100 responses in the MSN protocol plugin can cause
+the application to attempt to access memory that it does not have access to.
+This only affects users who have turned on the HTTP connection method for their
+accounts (it's off by default). This might only be triggerable by a malicious
+server and not a malicious peer. We believe remote code execution is not
+possible.
+
+### Mitigation
+
+Correctly take into account the size of HTTP 100 response when parsing server
+messages.
+
diff --git a/hugo/content/about/security/advisories/cve-2011-3185-00.md b/hugo/content/about/security/advisories/cve-2011-3185-00.md
new file mode 100644
--- /dev/null
+++ b/hugo/content/about/security/advisories/cve-2011-3185-00.md
@@ -0,0 +1,23 @@
+---
+title: cve-2011-3185-00
+date: 2011-08-20T00:00:00.000Z
+cveNumber: cve-2011-3185
+summary: Pidgin uses clickable links to untrusted executables
+discoveredBy: James Burton, Insomnia Security
+fixedInRelease: 2.10.0
+type: security
+layout: cve
+hidden: true
+---
+
+### Description
+
+If a user clicks on a file:// URI in a received IM in Windows builds of Pidgin,
+Pidgin attempts to execute the file. This can be dangerous if the file:// URI is
+a path on a network share.
+
+### Mitigation
+
+Don't attempt to execute files when the user clicks a file:// URI. Instead, open
+a file browser at the file's location.
+
diff --git a/hugo/content/about/security/advisories/cve-2011-3594-00.md b/hugo/content/about/security/advisories/cve-2011-3594-00.md
new file mode 100644
--- /dev/null
+++ b/hugo/content/about/security/advisories/cve-2011-3594-00.md
@@ -0,0 +1,22 @@
+---
+title: cve-2011-3594-00
+date: 2011-09-29T00:00:00.000Z
+cveNumber: cve-2011-3594
+summary: SILC remote crash
+discoveredBy: Diego Bauche Madero from IOActive
+fixedInRelease: 2.10.1
+type: security
+layout: cve
+hidden: true
+---
+
+### Description
+
+When receiving various incoming messages, the SILC protocol plugin failed to
+validate that a piece of text was UTF-8. In some cases invalid UTF-8 data would
+lead to a crash.
+
+### Mitigation
+
+Validate incoming strings as UTF-8 before using them as such.
+
diff --git a/hugo/content/about/security/advisories/cve-2011-4601-00.md b/hugo/content/about/security/advisories/cve-2011-4601-00.md
new file mode 100644
--- /dev/null
+++ b/hugo/content/about/security/advisories/cve-2011-4601-00.md
@@ -0,0 +1,23 @@
+---
+title: cve-2011-4601-00
+date: 2011-10-20T00:00:00.000Z
+cveNumber: cve-2011-4601
+summary: AIM and ICQ remote crash
+discoveredBy: Evgeny Boger
+fixedInRelease: 2.10.1
+type: security
+layout: cve
+hidden: true
+---
+
+### Description
+
+When receiving various messages related to requesting or receiving authorization
+for adding a buddy to a buddy list, the oscar protocol plugin failed to validate
+that a piece of text was UTF-8. In some cases invalid UTF-8 data would lead to a
+crash.
+
+### Mitigation
+
+Validate incoming strings as UTF-8 before using them as such.
+
diff --git a/hugo/content/about/security/advisories/cve-2011-4602-00.md b/hugo/content/about/security/advisories/cve-2011-4602-00.md
new file mode 100644
--- /dev/null
+++ b/hugo/content/about/security/advisories/cve-2011-4602-00.md
@@ -0,0 +1,22 @@
+---
+title: cve-2011-4602-00
+date: 2011-12-10T00:00:00.000Z
+cveNumber: cve-2011-4602
+summary: XMPP remote crash
+discoveredBy: Thijs Alkemade
+fixedInRelease: 2.10.1
+type: security
+layout: cve
+hidden: true
+---
+
+### Description
+
+When receiving various stanzas related to voice and video chat, the XMPP
+protocol plugin failed to ensure that the incoming message contained all
+required fields, and would crash if certain fields were missing.
+
+### Mitigation
+
+Check for missing fields and handle them appropriately.
+
diff --git a/hugo/content/about/security/advisories/cve-2011-4603-00.md b/hugo/content/about/security/advisories/cve-2011-4603-00.md
new file mode 100644
--- /dev/null
+++ b/hugo/content/about/security/advisories/cve-2011-4603-00.md
@@ -0,0 +1,23 @@
+---
+title: cve-2011-4603-00
+date: 2011-09-29T00:00:00.000Z
+cveNumber: cve-2011-4603
+summary: SILC remote crash
+discoveredBy: Diego Bauche Madero from IOActive
+fixedInRelease: 2.10.1
+type: security
+layout: cve
+hidden: true
+---
+
+### Description
+
+When receiving various incoming messages, the SILC protocol plugin failed to
+validate that a piece of text was UTF-8. In some cases invalid UTF-8 data would
+lead to a crash. This vulnerability is similar to CVE-2011-3594, but occurs in a
+different piece of code and was fixed at a later date.
+
+### Mitigation
+
+Validate incoming strings as UTF-8 before using them as such.
+
diff --git a/hugo/content/about/security/advisories/cve-2011-4939-00.md b/hugo/content/about/security/advisories/cve-2011-4939-00.md
new file mode 100644
--- /dev/null
+++ b/hugo/content/about/security/advisories/cve-2011-4939-00.md
@@ -0,0 +1,21 @@
+---
+title: cve-2011-4939-00
+date: 2011-07-08T00:00:00.000Z
+cveNumber: cve-2011-4939
+summary: XMPP remote crash
+discoveredBy: Clemens Huebner in ticket #14392 and Kevin Stange
+fixedInRelease: 2.10.2
+type: security
+layout: cve
+hidden: true
+---
+
+### Description
+
+Certain types of nickname changes in XMPP chat rooms can trigger a NULL pointer
+dereference in Pidgin, which triggers a crash.
+
+### Mitigation
+
+Check for NULL before trying to use a struct.
+
diff --git a/hugo/content/about/security/advisories/independent-20110206-00.md b/hugo/content/about/security/advisories/independent-20110206-00.md
new file mode 100644
--- /dev/null
+++ b/hugo/content/about/security/advisories/independent-20110206-00.md
@@ -0,0 +1,19 @@
+---
+title: independent-20110206-00
+date: 2011-02-06T00:00:00.000Z
+summary: Cipher API information disclosure
+discoveredBy: Julia Lawall
+fixedInRelease: 2.7.10
+type: security
+layout: cve
+hidden: true
+---
+
+### Description
+
+It was discovered that libpurple versions prior to 2.7.10 do not properly clear certain data structures used in libpurple/cipher.c prior to freeing. An attacker could potentially extract partial information from memory regions freed by libpurple.
+
+### Mitigation
+
+Proper structure clearing has been implemented.
+
