Security bugs are reported here via bugzilla

[Andrew <afrayedknot AT thefrayedknot.armory.com>]

I think stable grimoire may need an update
test/devel is on 1.2.1 but stable is still 1.1.4

----- Forwarded message from Mandriva Security Team <security AT mandriva.com> 
-----

Delivered-To: afrayedknot AT thefrayedknot.armory.com
Delivered-To: mailing list bugtraq AT securityfocus.com
Delivered-To: moderator for bugtraq AT securityfocus.com
From: Mandriva Security Team <security AT mandriva.com>
To: bugtraq AT securityfocus.com
Subject: MDKSA-2005:071 - Updated gaim packages fix multiple vulnerabilities
Date: Wed, 13 Apr 2005 20:32:16 -0600
X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=0.93.3.1
X-Spam-Level: 
X-Spam-Status: No, score=-14.7 required=5.0 tests=BAYES_00,
        DATE_IN_FUTURE_06_12,DNS_FROM_RFC_POST,USER_IN_DEF_WHITELIST 
        autolearn=no version=3.0.2

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

 _______________________________________________________________________

                Mandriva Linux Security Update Advisory
 _______________________________________________________________________

 Package name:           gaim
 Advisory ID:            MDKSA-2005:071
 Date:                   April 13th, 2005

 Affected versions:      10.1, Corporate 3.0
 ______________________________________________________________________

 Problem Description:

 More vulnerabilities have been discovered in the gaim instant messaging
 client:
 
 A buffer overflow vulnerability was found in the way that gaim escapes
 HTML, allowing a remote attacker to send a specially crafted message
 to a gaim client and causing it to crash (CAN-2005-0965).
 
 A bug was discovered in several of gaim's IRC processing functions
 that fail to properly remove various markup tags within an IRC message.
 This could allow a remote attacker to send specially crafted message to
 a gaim client connected to an IRC server, causing it to crash
 (CAN-2005-0966).
 
 Finally, a problem was found in gaim's Jabber message parser that would
 allow a remote Jabber user to send a specially crafted message to a
 gaim client, bausing it to crash (CAN-2005-0967).
 
 Gaim version 1.2.1 is not vulnerable to these issues and is provided
 with this update.
 _______________________________________________________________________

 References:

  http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-0965
  http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-0966
  http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-0967
 ______________________________________________________________________

 Updated Packages:
  
 Mandrakelinux 10.1:
 f0c9f84d95541ffba3baf9e24d85e87a  10.1/RPMS/gaim-1.2.1-0.1.101mdk.i586.rpm
 75941740b8e5db4603816d3ea73cfddf  
10.1/RPMS/gaim-devel-1.2.1-0.1.101mdk.i586.rpm
 334adccd0d97f287a0282f236311c495  
10.1/RPMS/gaim-gevolution-1.2.1-0.1.101mdk.i586.rpm
 7c8c86d36881bca9f539c7c8dfc543cc  
10.1/RPMS/gaim-perl-1.2.1-0.1.101mdk.i586.rpm
 361e053e145405c5cf95c9fadafa21b1  
10.1/RPMS/gaim-tcl-1.2.1-0.1.101mdk.i586.rpm
 dc4c479784bda506fc895441028b2985  
10.1/RPMS/libgaim-remote0-1.2.1-0.1.101mdk.i586.rpm
 342d279dbb9a076a03c596d6c1729d77  
10.1/RPMS/libgaim-remote0-devel-1.2.1-0.1.101mdk.i586.rpm
 6de0f7edf8c55a755c4b64809e1a246f  10.1/SRPMS/gaim-1.2.1-0.1.101mdk.src.rpm

 Mandrakelinux 10.1/X86_64:
 c51c050ac997d33f37cff42f1ddd8ee3  
x86_64/10.1/RPMS/gaim-1.2.1-0.1.101mdk.x86_64.rpm
 ce76925c9ea35890fe06c2266f87f1a4  
x86_64/10.1/RPMS/gaim-devel-1.2.1-0.1.101mdk.x86_64.rpm
 f862609115d62357ee65409e3accb9a0  
x86_64/10.1/RPMS/gaim-gevolution-1.2.1-0.1.101mdk.x86_64.rpm
 f53dee67ae2ddfa5a46b8eccd7e8ffc8  
x86_64/10.1/RPMS/gaim-perl-1.2.1-0.1.101mdk.x86_64.rpm
 705b7a40f55d4c2c71f69b6d074cb879  
x86_64/10.1/RPMS/gaim-tcl-1.2.1-0.1.101mdk.x86_64.rpm
 18330f6a2b207cad6d8456c724ea9a1f  
x86_64/10.1/RPMS/lib64gaim-remote0-1.2.1-0.1.101mdk.x86_64.rpm
 e05d76f087b39d233ba73eedcc3e7063  
x86_64/10.1/RPMS/lib64gaim-remote0-devel-1.2.1-0.1.101mdk.x86_64.rpm
 6de0f7edf8c55a755c4b64809e1a246f  
x86_64/10.1/SRPMS/gaim-1.2.1-0.1.101mdk.src.rpm

 Corporate 3.0:
 02619cb85a0a8846294c8ecdc2697231  
corporate/3.0/RPMS/gaim-1.2.1-0.1.C30mdk.i586.rpm
 0686d195bd0e1a69c9fd8e2952d6e31e  
corporate/3.0/RPMS/gaim-devel-1.2.1-0.1.C30mdk.i586.rpm
 1057d2753906d97367b596be55694546  
corporate/3.0/RPMS/gaim-perl-1.2.1-0.1.C30mdk.i586.rpm
 d69fc3be71d44677023d4902af8081a4  
corporate/3.0/RPMS/gaim-tcl-1.2.1-0.1.C30mdk.i586.rpm
 a3d62bec1d30efef4cde7ae80cc6f3b1  
corporate/3.0/RPMS/libgaim-remote0-1.2.1-0.1.C30mdk.i586.rpm
 ae7cec269ef28eb3664ad6941ff02e88  
corporate/3.0/RPMS/libgaim-remote0-devel-1.2.1-0.1.C30mdk.i586.rpm
 9ca50a9a0a46f5e616f9dd3f00e7dc52  
corporate/3.0/SRPMS/gaim-1.2.1-0.1.C30mdk.src.rpm

 Corporate 3.0/X86_64:
 5e69467d59933b94614a9567e50f22dc  
x86_64/corporate/3.0/RPMS/gaim-1.2.1-0.1.C30mdk.x86_64.rpm
 00f868d0fce79a2557bcc7cc6f9a04f2  
x86_64/corporate/3.0/RPMS/gaim-devel-1.2.1-0.1.C30mdk.x86_64.rpm
 703d5bca6aea8fa580500a19096ef8e5  
x86_64/corporate/3.0/RPMS/gaim-perl-1.2.1-0.1.C30mdk.x86_64.rpm
 f76af359b96e10c8707b14f110031491  
x86_64/corporate/3.0/RPMS/gaim-tcl-1.2.1-0.1.C30mdk.x86_64.rpm
 760124434b0c5b6e8420dc1e13c3533f  
x86_64/corporate/3.0/RPMS/lib64gaim-remote0-1.2.1-0.1.C30mdk.x86_64.rpm
 f53b90f50d2934bc070ca6ebb1a9324e  
x86_64/corporate/3.0/RPMS/lib64gaim-remote0-devel-1.2.1-0.1.C30mdk.x86_64.rpm
 9ca50a9a0a46f5e616f9dd3f00e7dc52  
x86_64/corporate/3.0/SRPMS/gaim-1.2.1-0.1.C30mdk.src.rpm
 _______________________________________________________________________

 To upgrade automatically use MandrakeUpdate or urpmi.  The verification
 of md5 checksums and GPG signatures is performed automatically for you.

 All packages are signed by Mandriva for security.  You can obtain the
 GPG public key of the Mandriva Security Team by executing:

  gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98

 You can view other update advisories for Mandriva Linux at:

  http://www.mandriva.com/security/advisories

 If you want to report vulnerabilities, please contact

  security_(at)_mandriva.com
 _______________________________________________________________________

 Type Bits/KeyID     Date       User ID
 pub  1024D/22458A98 2000-07-10 Mandriva Security Team
  <security*mandriva.com>

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.4 (GNU/Linux)

iD8DBQFCXdYwmqjQ0CJFipgRAiuIAJ0cS6yu54U+jEevRA4vmFEGYTdk4gCghOdV
QVG5/7iUy+TBjcEvfVHEaek=
=+qyw
-----END PGP SIGNATURE-----

----- End forwarded message -----