| Name | CVE-2017-2640 |
| Description | Out-of-bounds write when stripping xml |
| Source | CVE (at NVD; CERT, LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, Mageia, GitHub code/issues, web search, more) |
| References | DLA-853-1, DSA-3806-1 |
| Debian Bugs | 859159 |
Vulnerable and fixed packages
The table below lists information on source packages.
| Source Package | Release | Version | Status |
|---|
| pidgin (PTS) | wheezy | 2.10.10-1~deb7u1 | vulnerable |
| wheezy (security) | 2.10.10-1~deb7u3 | fixed |
| jessie (security), jessie | 2.11.0-0+deb8u2 | fixed |
| stretch | 2.12.0-1 | fixed |
| buster, sid | 2.13.0-1 | fixed |
The information below is based on the following data on fixed versions.
Notes
https://www.pidgin.im/news/security/?id=109
https://bitbucket.org/pidgin/main/commits/b2fc9e774cb9