CVE request - pidgin MSN arbitrary file upload

[Paul Aurich <paul () darkrain42 org>]

http://events.ccc.de/congress/2009/Fahrplan/events/3596.en.html

In Fabian's talk, he describes an issue where Pidgin's MSN prpl does not
validate the filename received in a request for Pidgin to upload a custom
emoticon to a third-party, allowing an attacker to download arbitrary files
on the system via directory traversal.

This is fixed in source, but no release yet:
http://d.pidgin.im/viewmtn/revision/info/c64a1adc8bda2b4aeaae1f273541afbc4f71b810

--
Paul Aurich

Attachment: signature.asc
Description: OpenPGP digital signature