This host is installed with Pidgin and is prone to information disclosure vulnerability.

Successful exploitation will allow attacker to gain sensitive information. Impact Level: Application

Upgrade to Pidgin version 2.7.10 or later, For updates refer to http://pidgin.im/download

The flaw is due to the 'md5_uninit()', 'md4_uninit()', 'des_uninit()', 'des3_uninit()', 'rc4_uninit()', and 'purple_cipher_context_destroy()' functions in libpurple/cipher.c not properly clearing certain sensitive structures, which can lead to potentially sensitive information disclosure remaining in memory.

Pidgin version prior 2.7.10 on Windows

• http://openwall.com/lists/oss-security/2012/01/04/13
• http://osvdb.org/show/osvdb/72798
• http://secunia.com/advisories/43271/
• http://www.pidgin.im/news/security/?id=50

---

Updated on 2015-03-25