CVE-2019-25544

Pidgin 2.13.0 contains a denial of service vulnerability that allows local attackers to crash the application by providing an excessively long username string during account creation. Attackers can input a buffer of 1000 characters in the username field and trigger a crash when joining a chat, causing the application to become unavailable.

Pidgin 2.13.0 contains a denial of service vulnerability that allows local attackers to crash the application by providing an excessively long username string during account creation. Attackers can input a buffer of 1000 characters in the username field and trigger a crash when joining a chat, causing the application to become unavailable.

Pidgin 2.13.0 contains a denial of service vulnerability that allows local attackers to crash the application by providing an excessively long username string during account creation. Attackers can input a buffer of 1000 characters in the username field and trigger a crash when joining a chat, causing the application to become unavailable.

Pidgin 2.13.0 contains a denial of service vulnerability that allows local attackers to crash the application by providing an excessively long username string during account creation. Attackers can input a buffer of 1000 characters in the username field and trigger a crash when joining a chat, causing the application to become unavailable.

Pidgin 2.13.0 contains a denial of service vulnerability that allows local attackers to crash the application by providing an excessively long username string during account creation. Attackers can input a buffer of 1000 characters in the username field and trigger a crash when joining a chat, causing the application to become unavailable.

This update for libgnt, meson, pidgin fixes the following issues

Security issue:

• CVE-2019-25544: denial of service vulnerability that allows local attackers to crash the application by providing an excessively long username string during account creation (bsc#1260058).

Non security issues:

Changes for meson:

• Update to version 0.46.0.

• Require python2-devel for the testsuite (bsc#1125736)

• Update to version 0.45.0:

• Config-Tool based dependencies can be specified in a cross file.
• Visual Studio C# compiler support.
• Removed two deprecated features:
• Generator outputs can preserve directory structure.
• Hexadecimal string literals.
• install_data()defaults to{datadir}/{projectname}`.
• install_subdir() supports strip_directory.
• Integer options.
• New method meson.project_license().
• Rust cross-compilation.
• Rust compiler-private library disambiguation.
• Project templates.
• Improve test setup selection.
• Yielding subproject option to superproject.

• Update to version 0.44.1:

• Support running out-of-tree tests against a meson in PATH.
• Don't add rpaths to system libraries.
• Fix meson location detection from other meson tools.
• Various boost, pkg-config and vala related fixes.

• Update to version 0.44.0:

• New features:

• Added warning function.
• Adds support for additional Qt5-Module keyword moc_extra_arguments.
• Prefix-dependent defaults for sysconfdir, localstatedir and sharedstatedir.
• An array type for user options.
• LLVM dependency supports both dynamic and static linking.
• Added if_found to subdir.
• get_unquoted() method for the configuration data object.
• Added disabler object.
• Config-Tool based dependencies gained a method to get arbitrary options.

• Disable tests for static llvm: we don't ship the static libs.
• Add cmake(Qt5LinguistTools), libwmf-devel BuildRequires and zlib-devel-static: new dependencies for various tests.

• Require python3-xml: mesonbuild/modules/qt5.py imports the xml module (bsc#1068818).

• Update to version 0.43.0:

• Generator learned capture: Generators can now be configured to capture the standard output.
• Can index CustomTarget objects: The CustomTarget object can now be indexed like an array. The resulting object can be used as a source file for other Targets, this will create a dependency on the original CustomTarget, but will only insert the generated file corresponding to the index value of the CustomTarget's output keyword.
• The cross file can now be used for overriding the result of find_program. Then issuing the command find_program('objdump') will return the version specified in the cross file.
• Easier handling of supported compiler arguments.
• Better support for shared libraries in non-system paths: This release adds feature parity to shared libraries that are either in non-standard system paths or shipped as part of your project. On systems that support rpath, Meson automatically adds rpath entries to built targets using manually found external libraries.
• The Wrap dependency system now supports Subversion (svn). This support is rudimentary. The repository url has to point to a specific (sub)directory containing the meson.build file (typically trunk/). However, providing a revision is supported.

• Don't use obsolete boost-devel for openSUSE Leap 15.0 and newer (bsc#1062785).

• Update to version 0.42.1.

• Tumbleweed meson 0.42.0-1.1fails for clang++ projects (bsc#1057701).

• Update to version 0.42.0:

• Distribution tarballs from Mercurial repositories. Creating distribution tarballs can now be made out of projects based on Mercurial. As before, this remains possible only with the Ninja backend.
• Keyword argument verification. Meson will now check the keyword arguments used when calling any function and print a warning if any of the keyword arguments is not known. In the future this will become a hard error.
• Add support for…