Update Pidgin to upstream 2.5.8 (fixes numerous issues)

Bug #393736 reported by Dominic Chen
14
This bug affects 2 people
Affects Status Importance Assigned to Milestone
pidgin (Ubuntu)
Fix Released
Wishlist
Iain Lane

Bug Description

Not only does the updated upstream fix the recent problems with Yahoo, but also includes security fixes (see 2.5.6 changelog; libpurple)

From http://developer.pidgin.im/wiki/ChangeLog:

Version 2.5.8 (06/27/2009)
    * ICQ
          o Fix misparsing a web message as an SMS message. (Yuriy Kaminskiy)
    * MSN
          o Increase NS command history size to prevent crashes on buddy lists that have a lot of buddies on other networks like Yahoo!
    * MySpace
          o Accounts with empty buddy lists are now properly marked as connected.
          o Fix receiving messages from users of MySpace IM's web client.
    * Yahoo
          o Fixed phantom online buddies. They should now properly disappear when signing out.
          o Fixed the crashes some users were seeing with cn.scs.msg.yahoo.com in 2.5.7.
          o Fixed compiling on systems with glib 2.4.x or older.
          o Fixed an issue with file transfers. This may not resolve all issues, but it should resolve at least some of the most common ones.
          o The pager server will automatically update to scsa.msg.yahoo.com if the user empties the field or if it is scs.msg.yahoo.com. This should ease the pain of transition to the new login method.
    * XMPP
          o Fix an incompatibility betweeen Prosody and libpurple clients.

Version 2.5.7 (06/20/2009)
    * Yahoo Protocol 16 support, including new HTTPS login method; this should fix a number of login problems that have recently cropped up. (Sulabh Mahajan, Mike "Maiku" Ruprecht)
    * Only display the AIM "Unable to Retrieve Buddy List" message once per connection. (Rob Taft)
    * Blocking MSN users not on your buddy list no longer disconnects you.
    * When performing operations on MSN, assume users are on the MSN/Passport network if we don't get network ID's for them.

Version 2.5.6 (05/19/2009)
    * libpurple
          o Improve sleep behavior by aggregation of longer timeouts on second boundaries to allow better power saving. (Arunan Balasubramaniam)
          o Fix various crashes on exit.
          o Make XML parsing more resilient to interactions with other libraries. This, along with the fix for libxml2 bug 564217, fixes the crashes on connect in XMPP with recent gst-plugins-bad (see #8830 for details).
          o Many security related fixes
    * IRC
          o Correctly handle WHOIS for users who are joined to a large number of channels.
          o Notify the user if a /nick command fails, rather than trying fallback nicks.
    * MSN
          o Fix a race condition causing occasional Pidgin crashes.
          o Fix some errors about the friendly name changing too fast caused by MSN/Yahoo integration buddies.
    * XMPP
          o Less likely to pop up a new conversation window in disregard of the "Hide new IM conversations" preference.
    * Yahoo
          o Fix a crash when sending very long messages.
          o Fix a bug where UTF-8 status messages get garbled when going idle.

Iain Lane (laney)
Changed in pidgin (Ubuntu):
assignee: nobody → Iain Lane (laney)
status: New → In Progress
Revision history for this message
Iain Lane (laney) wrote :

pidgin (1:2.5.8-1ubuntu1) karmic; urgency=low

  * Merge with Debian unstable (LP: #393736), remaining changes:
    + debian/prefs.xml: Update to set the notify plugin prefs
      /plugins/gtk/X11/notify/*, set /pidgin/plugins/loaded to load
      the notify plugin and enable the standard logging options by default
    + 02_lpi.patch for LP integration. Add liblaunchpad-integration-dev to
      build-deps for this
    + 04_let_crasher_for_apport.patch to stop catching the SIGSEGV signal
      and let apport handle it
    + 05_default_to_irc_ubuntu_com.patch to set the default IRC
      server to irc.ubuntu.com
    + 10_docklet_default_off.patch for default behavior to have no
      notification area icon.
    + 11_buddy_list_really_show.patch to make it so that the buddy
      list tries harder to appear. This fixes some issues with it
      not appearing.
    + 13_sounds_and_timers.patch which adjusts the time out for sounds
      to be 15 seconds, which helps get fewer spurious login
      notifications on slow connections. Also, switches a few long
      term timers to _add_seconds to get a little bit of power savings.
    + 60_1024x600_gtk*.c.patch: Add scrolled bars into account dialog,
    + 73_upstream_change_fix_high_dpi_status_msg.patch: upstream change to
      stop the clipping of the infopane text when using high DPI
      pounce windows and preference window when screen height is less than 600.
    + Add nm-dev to build-deps to enable NM integration. Remove --disable-nm
      from configure line to enable this support.
    + debian/libpurple0.symbols: Add libgdl & epochs
    + debian/control: Remove libpurple0 from deps of libpurple-bin
  * Also fixes Yahoo! connection problems
  * 99_autoconf: Drop, do full autoreconf in 99_autoreconf; autofoo related build
    failures without this

 -- Iain Lane <email address hidden> Wed, 01 Jul 2009 10:27:14 +0100

Revision history for this message
Sebastien Bacher (seb128) wrote :

thank you for your work there

Changed in pidgin (Ubuntu):
importance: Undecided → Wishlist
status: In Progress → Fix Committed
Revision history for this message
Launchpad Janitor (janitor) wrote :

This bug was fixed in the package pidgin - 1:2.5.8-1ubuntu1

---------------
pidgin (1:2.5.8-1ubuntu1) karmic; urgency=low

  * Merge with Debian unstable (LP: #393736), remaining changes:
    + debian/prefs.xml: Update to set the notify plugin prefs
      /plugins/gtk/X11/notify/*, set /pidgin/plugins/loaded to load
      the notify plugin and enable the standard logging options by default
    + 02_lpi.patch for LP integration. Add liblaunchpad-integration-dev to
      build-deps for this
    + 04_let_crasher_for_apport.patch to stop catching the SIGSEGV signal
      and let apport handle it
    + 05_default_to_irc_ubuntu_com.patch to set the default IRC
      server to irc.ubuntu.com
    + 10_docklet_default_off.patch for default behavior to have no
      notification area icon.
    + 11_buddy_list_really_show.patch to make it so that the buddy
      list tries harder to appear. This fixes some issues with it
      not appearing.
    + 13_sounds_and_timers.patch which adjusts the time out for sounds
      to be 15 seconds, which helps get fewer spurious login
      notifications on slow connections. Also, switches a few long
      term timers to _add_seconds to get a little bit of power savings.
    + 60_1024x600_gtk*.c.patch: Add scrolled bars into account dialog,
    + 73_upstream_change_fix_high_dpi_status_msg.patch: upstream change to
      stop the clipping of the infopane text when using high DPI
      pounce windows and preference window when screen height is less than 600.
    + Add nm-dev to build-deps to enable NM integration. Remove --disable-nm
      from configure line to enable this support.
    + debian/libpurple0.symbols: Add libgdl & epochs
    + debian/control: Remove libpurple0 from deps of libpurple-bin
  * Also fixes Yahoo! connection problems
  * 99_autoconf: Drop, do full autoreconf in 99_autoreconf; autofoo related build
    failures without this

 -- Iain Lane <email address hidden> Wed, 01 Jul 2009 10:27:14 +0100

Changed in pidgin (Ubuntu):
status: Fix Committed → Fix Released
Revision history for this message
Dominic Chen (ddcc) wrote :

Could the priority of the package be elevated? See http://secunia.com/advisories/35652/f

Revision history for this message
Hew (hew) wrote :

This bug is already Fix Released, since it has been applied to Ubuntu Karmic. There is no need to update the importance of a closed bug.

The security issue you mention, CVE-2009-1889, is still "under review", and the page you linked lists it as "not critical". Once it is officially on the CVE list you may wish to report this as a new security bug, in order for SRUs to be issued.

To post a comment you must log in.
This report contains Public information  
Everyone can see this information.

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.