-
Notifications
You must be signed in to change notification settings - Fork 6
/
Copy pathChangeLog
5271 lines (4757 loc) · 224 KB
/
ChangeLog
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
996
997
998
999
1000
Pidgin and Finch: The Pimpin' Penguin IM Clients That're Good for the Soul
version 2.14.12 (12/31/2022):
* Remove a string from the Romanian translation that's breaks the creation
of the Windows installer. (RR 2157) (Gary Kramlich)
version 2.14.11 (12/31/2022):
* Add Markus "ivanhoe" Fischer to the Crazy Patch Writers! Congrats Markus!
(RR 1952) (Gary Kramlich)
* Fix a crash when closing a group chat with spellchk plugin enabled. (RR
1951) (Markus Fischer)
* Fix network interface detection on Windows to fix broken file transfers.
(PIDGIN-17123, PIDGIN-17293, PIDGIN-17516, PIDGIN-17704) (RR 2018) (Gary
Kramlich)
* Update the about box to point people to Discourse instead of the mailing
lists. (RR 2154) (Gary Kramlich)
version 2.14.10 (06/02/2022):
General:
* Audit and correct the COPYRIGHT file. (RR 1425) (Richard Laager)
* Fix a spelling error in a debug message for proxies. (RR 1426) (Richard
Laager)
* Install some emojis already in the theme but not being installed.
(RR 1428) (Richard Laager)
* Drop the QQ smileys as we don't ship QQ anymore. (PIDGIN-14385) (RR 1429)
(Richard Laager)
* Modernize the desktop file. (RR 1433) (Richard Laager)
* Modernize the appdata file. (RR 1431) (Richard Laager)
* Make privacy settings persist. (PIDGIN-17137) (RR 1463) (Belgin Știrbu)
Pidgin:
* Fix a use after free that was introduced in 2.14.9. (RR 1488) (ivanhoe)
IRC:
* Fix a crash if the server sends a short form JOIN message. (PIDGIN-17375)
(RR 1484) (Belgin Știrbu)
XMPP:
* Fix a regression from 2.14.9 where XMPP accounts state would get lost
after failing to connect. (PIDGIN-17621) (RR 1455) (Belgin Știrbu)
* Fix a crash when requesting your own info in an XMPP conference. (RR 1465)
(Belgin Știrbu)
* Fix hang when completing a file transfer over XMPP. (RR 1466) (Belgin
Știrbu)
* Fix updating custom smileys. (PIDGIN-17153) (RR 1477) (Belgin Știrbu)
* Fix unblocking users. (PIDGIN-16414) (RR 1479) (Belgin Știrbu)
* Fix a crash when cancelling a file transfer. (PIDGIN-17189) (RR 1485)
(Belgin Știrbu)
version 2.14.9 (04/28/2022):
Security:
* Remove _xmppconnect support. (RR 1357) (CVE-2022-26491) (Gary Kramlich)
libpurple:
* Fix a GLib CRITICAL message with typing time outs. (RR 1123) (Mohammed
Sadiq)
* Fix an issue where the unit tests for purple_str_to_time would fail.
(GENTOO-819774) (RR 1238) (Gary Kramlich)
Pidgin:
* Fix a memory leak in pidgin_conversations_set_tab_colors. (RR 1244)
(ivanhoe)
* Fixed the majority of the infinite resizing issues in the input box.
(PIDGIN-16753, PIDGIN-16999, PIDGIN-17287, PIDGIN-17413, PIDGIN-17430,
PIDGIN-17568, PIDGIN-17602) (RR 1342) (Belgin Știrbu)
* Add transient-buddy back which is used to show some context menus and
other things. (PIDGIN-17523) (RR 1381) (Belgin Știrbu)
Windows:
* Fix the download of dictionaries in the Windows installer. (PIDGIN-14618,
PIDGIN-15648, PIDGIN-15540, PIDGIN-14612, PIDGIN-14893) (RR 1303) (Gary
Kramlich)
Translations:
* Fix a typo in the German translations. (PIDGIN-17575) (RR 1242) (ivanhoe)
* Synced all of the translations with Transifex.
IRC:
* Fix IRC file transfers on Windows. (PIDGIN-17175) (RR 1382) (Belgin
Știrbu)
* Fix file transfers failing at 99% on IRC. (PIDGIN-15893) (RR 1385) (Belgin
Știrbu)
* Default realname and ident name in IRC to the username (nickname) of the
account. (PIDGIN-17610) (RR 1386) (Belgin Știrbu)
* Add an advanced account option to IRC accounts for explicitly setting the
SASL login name. (PIDGIN-15451) (RR 1388) (Belgin Știrbu)
* Added a rate limiter that should make it impossible to excess flood.
(RR 1391) (Gary Kramlich)
SIMPLE:
* Fix an issue with the CSeq numbers in SIMPLE. (PIDGIN-9675) (RR 1379)
(dohmniq)
XMPP:
* Fix XMPP attention messages being sent to incorrect JIDs. (PIDGIN-14714)
(RR 1387) (itsnotabigtruck, Belgin Știrbu)
version 2.14.8 (10/14/2021):
libpurple:
* Fix a regression in purple_str_to_time. (PIDGIN-17552) (RR 931) (Gary
Kramlich)
XMPP:
* Fix a double free in jabber/message.c. (PIDGIN-17547) (RR 932) (Gary
Kramlich, pv32768)
Pidgin:
* Fix the link to the support mailing list archive in the About Dialog.
(RR 929) (Gary Kramlich)
version 2.14.7 (09/16/2021):
libpurple:
* Fix leak in purple_markup_find_tag on error. (OSS-FUZZ 35816) (RR 924)
(Elliott Sales de Andrade)
* Fix an issue where the XMPP utility tests would fail if libidn was
disabled. (RR 922) (Gary Kramlich)
* Fix an assert in purple_markup_html_to_xhtml (OSS-FUZZ 35029) (RR 921)
(Elliott Sales de Andrade)
* Fix building on Haiku (RR 916) (Haiku Ports Team)
* Correctly free parse tags at end of purple_html_to_xhtml (OSS-FUZZ 34996)
(RR 913) (Elliott Sales de Andrade)
* Fix leak that may occur when xmlnode_from_str fails (OSS-FUZZ 34988)
(RR 911) (Elliott Sales de Andrade)
* Cleanup, standardize and create starting corpora for all of the fuzzers.
(RR 920) (Gary Kramlich)
* Port purple_str_to_time to use a regular expression and add additional
unit tests for it. (RR 923) (Gary Kramlich)
version 2.14.6 (07/08/2021):
General:
* Update references to point to our current websites. (RR 766) (Gary
Kramlich)
* Add a donate link to the help menu. (RR 749) (Gary Kramlich)
Finch:
* Check pkg-config for ncurses before looking for it manually. (RR 729)
(Justin Lecher)
Pidgin:
* Replace newlines in topics with spaces. (PIDGIN-16704) (RR 730) (Gary
Kramlich)
libpurple:
* Added support for the no_proxy environment variable. (PIDGIN-17518)
(RR #667) (Alynx Zhou and Gary Kramlich)
* Added infrastructure for fuzzing as well as some initial fuzzers.
(RR #760) (Jordy Zomer)
* Fix an out of bounds write in purple_markup_linkify. (RR 781) (Thomas
Roth, Dominik Maier, and Fabian Freyer)
XMPP:
* Enable session management after binding a resource. (PIDGIN-17520) (RR
759) (defanor)
Zephyr:
* Fix a clang logical-not-parentheses warning. (PIDGIN-17528) (RR 731)
(Gary Kramlich)
version 2.14.5 (06/03/2021):
General:
* Updated our bundled certificates to the latest version from Mozilla.
(RR #722) (PIDGIN-17535) (Gary Kramlich)
* Made the project scan-build clean. (RR #692-705, #707-714, #716-#719)
(Gary Kramlich)
* Fixed some of Gary's scan-build fixes that were a bit verbose. (RR #715)
(Elliott Sales de Andrade)
* Disabled UPnP and NAT-PMP by default for new user. (RR #706) (Gary
Kramlich)
IRC:
* Changed the default server to irc.libera.chat. (RR #675) (Gary Kramlich)
Windows Specific Changes:
* Fixed the installer not running when Mandatory ASLR was turned on.
(RR #721) (PIDGIN-17524) (Gary Kramlich)
version 2.14.4 (04/29/2021):
General:
* Use LT_LIB_M to find the math library. This should simplify things for
various distros including the BSD's. (RR #608) (and, Justin Lechner)
libpurple:
* Removed a dangling reference to oscar that was causing the unit tests
to fail. (RR #605) (Gary Kramlich)
* Update purple-remote and purple-url-handler to have a Python 3 shebang.
(RR #609) (Richard Laager)
Pidgin:
* Install our AppData file into the $prefix/share/metainfo. (RR 607)
(Lars Wendler)
* Re-enable the Gevolution plugin and set the evolution-data-server
requirement to >= 3.6. (RR #610) (Ed Catmur, Lars Wendler)
Windows-Specific Changes:
* Output pkg-config files so that our Windows builds can be seen by meson.
Grim owes a blog post on how this works. (RR #615) (Gary Kramlich)
* Update the debug symbols download in the installer to the inetc plugin.
(RR #627) (Gary Kramlich)
* Make sure the uninstaller removes all files that we install. (RR #612)
(Gary Kramlich)
version 2.14.3 (04/08/2021):
libpurple:
* Removed the AIM protocol plugin. AIM has been shut down since December
15th of 2017. We left it around because of a third party server, but our
plugin no longer works with it. (RR #598) (Gary Kramlich)
Windows-Specific Changes:
* Standardize on wprintf in pidgin/win32/winpidgin.c (RR #593) (Gary
Kramlich)
* Use the inetc nsis plugin that supports https (RR #593, #594)
(PIDGIN-17511) (Gary Kramlich)
* If building under msys2 copy libgcc_s_dw2-1.dll and libwinpthread to the
install directory. (RR #593) (PIDGIN-17511) (Gary Kramlich)
version 2.14.2 (04/01/2021):
* Fix a build issue when compiling with gstreamer but without voice and
video. (RR #25)
* Enable cyrus-sasl by default. (RR #26)
* Fix an issue with opening link in Firefox. (RR #503) (PIDGIN-16589)
* Fix a regression from 2.14.0 where extra whitespace would be displayed
when pasting <p> elements from HTML. (RR #504) (PIDGIN-17437)
* Require Python 3 for generating the D-Bus bindings. (RR #550)
* Fix an issue where pasting <hr>'s and other HTML elements would
eventually lead to a crash. (RR #514) (PIDGIN-17446)
version 2.14.1 (11/06/2020):
* Fixed issues with Windows installer that always thought Pidgin was
running. (Eion Robb)
* Fixed an issue where the Windows installer was not using Unicode while
doing checksums which made it fail. (Eion Robb)
* Fixed an issue in the released source code that caused the Mercurial
revision in the About box to be "unknown". (Gary Kramlich)
version 2.14.0 (10/06/2020):
General:
* Fixed a memory leak in search results. (#17292 PR #320 David Woodhouse)
* Support SNI with GNUTLS. (#17300 tiagosalem) (PR #659 Mihai Moldovan)
* Add additional error handling to NSS and GNUTLS. (PR #679 Samuel Thibault)
libpurple:
* Add invisible buddy support to support presence/name/photos for non
buddies. (#17295 PR 321 David Woodhouse)
* Make purple-remote compatible with both Python 2 and Python 3. (Jan
Synacek of RedHat)
* Fixed some leaky deprecation warnings. (PR #586 Gary Kramlich)
* Fixed HTML logs which were writing invalid HTML. (#17280 stars PR #312
Daniel Kamil Kozar)
* Fixed a use after free in purple_smiley_set_data_impl. (PR #694 Gary
Kramlich)
* Added the chat_send_file ability to protocol plugins. (PR #701 David
Woodhouse)
Pidgin:
* Treat <p> tags as line breaks when pasting. (PR #678 Colin Xu)
* Reverted Ticket #17232/PR #695. It caused more harm than good and a new
solution needs to be found. (PR #695 Gary Kramlich)
Bonjour:
* Always use port fallback for IPv4 addresses. (PR #382 Michael Osborne)
XMPP:
* Support for XEP-0198 Stream Management (PR #309 defanor)
* Decrease delay for file transfer using streamhosts (PR #464 #627 Evert
Mouw)
Voice & Video:
* Improve webcam failure handling. (PR #322 David Woodhouse)
* Show error when creating media pipeline fails. (#17290 PR 322 David
Woodhouse)
* Clip audio level reporting. (#14426 PR #322 David Woodhouse)
* Keep track of devices managed by GstDeviceMonitor. (PR #322 David
Woodhouse)
* Ignore PulseAudio monitors. (PR #322 David Woodhouse)
* Backport native Voice & Video prefs from 3.0. (PR #322 David Woodhouse)
* Fixed building against GStreamer 0.10 (PR #325 David Woodhouse)
* Fixed initial delay on incoming audio (PR #379 David Woodhouse)
* Properly cleanup timeouts. (PR #383 Jakub Adam)
* Added an audio mixer so mixed sources don't cause a pipe failure. (PR #522
Fabrice Bellet)
* Added screen share support for Wayland via XDP Portal. (PR #337 David
Woodhouse)
* Handle unplug and replug events of selected media device. (PR #699 David
Woodhouse)
version 2.13.0 (03/08/2018):
libpurple:
* Unified string comparison. (PR #186) (Arkadiy Illarionov)
* Properlly shell escape URI's when opening them. (PR #271 Daniel Kamil Kozar)
* Fix a one byte buffer overread in function purple_markup_linkify
* Fix an issue were utf8 was incorrectly truncated which could lead to
crashes as we were potentially feeding garbage into glib/gtk.
libgnt:
* Fixed build against curses 6.0 with opaque structs set. (#16764 dimstar)
(PR #268 Daniel Kamil Kozar)
* Fixed a crash when resizing the window. (#16680 marcus) (PR #269 Daniel Kamil Kozar)
General:
* Fixed bashism in autotools. (#16836 lameventanas) (PR #267 Daniel Kamil Kozar)
XMPP:
* Show XEP-0066 OOB URLs in any message, not just headlines
* Fix a user after free (#17200 debarshiray) (PR #266 Ethan Blanton)
* Removed pipelining from BOSH connections (#17025 PR #295 Tom Li)
* Don't try to TLS already secured BOSH connections (#17270 PR #293 Tom Li)
IRC:
* Fix "Registration timeout" on SASL auth with InspIRCd servers
(and possibly others not based on charybdis/ratbox/ircd-seven)
* Fix issues with plugins that modify outgoing messages
(such as the custom PART/QUIT feature of the IRC More plugin)
* Fix IRC buffer handling. (#12562 PR #272 Shivaram Lingamneni)
* Properly handle AUTHENTICATE as a normal command with server prefix.
(PR #316 dx)
* Fix a crash caused by a use after free of the MOTD.
* Fix an out of bounds read in irc_nick_skip_mode.
* Fix a write of a single byte before the start of a buffer in
irc_parse_ctcp.
Pidgin:
* Better support for dark themes. (#12572 Alyssa Rosenzweig and Gary Kramlich)
* Fixed IPv6 links by not escaping []'s. (#16391 cyisfor) (PR #270 Daniel Kamil Kozar)
* Only write buddy icons to the cache if they're not already cached. (PR #276 David Woodhouse)
* Rejoin persistent chats after reconnect. (#15687 PR #285 Christof Meerwald)
* Made the WIN32 Transparency plugin work on all platforms. (#3124 PR #287 Daniel Kamil Kozar)
* Ensure search results buttons are labeled (Backport from de2d88e575ee)
* Fix matching unicode smilies. (#17232 gnubfx PR #262 Daniel Kamil Kozar)
* Correctly update mute/unmute status when the remote side mutes/unmutes us. (#17273 PR #302 David Woodhouse)
* Rework the status icon blinking to not used deprecated API. (#17174 zelch PR #264 Daniel Kamil Kozar)
* Don't allow adding a buddy to protocols that don't have an add_buddy callback. (#4061 Paradox)
Finch:
* Fix handling of search results (#17238 David Woodhouse)
Voice & Video:
* Port backend-fs to newer api for farstream relay-info property (#17274 bellet)
version 2.12.0 (03/09/2017):
libpurple:
* Fix an out of bounds memory write in purple_markup_unescape_entity.
CVE-2017-2640
* Fix use of uninitialised memory if running non-debug-enabled versions of glib
* Updated AIM dev and dist ID's to new ones that were assigned by AOL.
* TLS certificate verification now uses SHA-256 checksums.
* Fixed SASL external auth for Freenode.
* Removed the MSN protocol plugin. It has been unusable and dormant for some
time. MSNP18 has been discontinued and the protocol plugin would require a
large update to start working again. See: http://ismsndeadyet.com/ The
third-party Pidgin SkypeWeb plugin, however, should provide enough
functionality as a replacement if people still want to use MSN:
https://github.com/EionRobb/skype4pidgin/tree/master/skypeweb
* Removed Mxit protocol plugin. The service was closed at the end of
September 2016. See
https://pidgin.im/pipermail/devel/2016-September/024078.htm
* Removed the MySpaceIM protocol plugin. The service has been defunct for a
long time. (#15356)
* Remove the Yahoo! protocol plugin. Yahoo has completely
reimplemented their protocol, so this version is no longer operable as
of August 5th, 2016:
https://yahoo.tumblr.com/post/145715934739/q2-2016-progress-report-on-our-product
A new protocol plugin has been written to support the new protocol.
It can be found here: https://github.com/EionRobb/funyahoo-plusplus
This also removes support for Yahoo! Japan. According to
http://messenger.yahoo.co.jp/ the service ended March 26th, 2014.
* Remove the Facebook (XMPP) account option. According to
https://developers.facebook.com/docs/chat the XMPP Chat API service
ended April 30th, 2015. A new protocol plugin has been written,
using a different method, to support Facebook. It can be found at
https://github.com/dequis/purple-facebook/wiki
* Fixed gnutls certificate validation errors that mainly affected google (Dequis)
General
* Replaced instances of d.pidgin.im with developer.pidgin.im and updated the
urls to use https. (#17036)
IRC
* Fixed issue of messages being silently cut off at 500 characters. Large
messages are now split into parts and sent one by one. (#4753)
version 2.11.0 (06/21/2016):
General:
* 2.10.12 was accidentally released with new additions to the API and
should have been released as 2.11.0. Unfortunately, we did not catch
the mistake until after 2.10.12 was released, but we're fixing it now.
See ChangeLog.API for more information.
* Include the Mozilla certificate bundle. This fixes connecting to servers
with certificates from Let's Encrypt.
* Remove all 1024-bit CAs
libpurple:
* media: fix an issue with ximagesink displaying only a corner cut-out of
a larger webcam video (Jakub Adam)
* mediamanager: update output window destruction so that it reflects recent
changes in the media pipeline structure (Jakub Adam)
* Ported Instantbird's CommandUiOps to libpurple (Dequis)
Pidgin:
* Fixed #14962
* Fixed alignment of incoming right-to-left messages in protocols that
don't support rich text
* Fix a potential crash while exiting pidgin
Windows-Specific Changes:
* Use getaddrinfo for DNS to enable IPv6 (#1075)
* Updates to dependencies:
* NSS 3.24 and NSPR 4.12.
AIM:
* Add support for the newer kerberos-based authentication of AIM 8.x
Bonjour
* Fixed building on Mac OSX (Patrick Cloke) (#16883)
ICQ:
* Stop truncating passwords to 8 characters like old ICQ clients did.
(#16692). If you actually needed this, truncate your password
manually by pressing backspace a few times.
IRC:
* Base64-decode SASL messages before passing to libsasl (#16268)
MXit
* Fixed a buffer overflow. Discovered by Yves Younan of Cisco Talos.
(TALOS-CAN-0120)
* Fixed a remote out-of-bounds read. Discovered by Yves Younan of Cisco
Talos. (TALOS-CAN-0140)
* Fixed a remote out-of-band read. Discovered by Yves Younan of Cisco
Talos. (TALOS-CAN-0138, TALOS-CAN-0135)
* Fixed an invalid read. Discovered by Yves Younan of Cisco Talos
(TALOS-CAN-0118)
* Fixed a remote buffer overflow vulnerability. Discovered by Yves
Younan of Cisco Talos. (TALOS-CAN-0119)
* Fixed an out-of-bounds read discovered by Yves Younan of Cisco Talos.
(TALOS-CAN-0123)
* Fixed a directory traversal issue. Discovered by Yves Younan of Cisco
Talos (TALOS-CAN-0128)
* Fixed a remote denial of service vulnerability that could result in
a null pointer dereference. Discovered by Yves Younan of Cisco Talos.
(TALOS-CAN-0133)
* Fixed a remote denial of service that could result in an out-of-bounds
read. Discovered by Yves Younan of Cisco Talos (TALOS-CAN-0134)
* Fixed multiple remote buffer overflows. Discovered by Yves Younan of
Cisco Talos. (TALOS-CAN-0136)
* Fixed a remote NULL pointer dereference. Discovered by Yves Younan of
Cisco Talos (TALOS-CAN-0137)
* Fixed a remote code execution issue discovered by Yves Younan of Cisco
Talos. (TALOS-CAN-0142)
* Fixed a remote denial of service vulnerability in contact mood
handling. Discovered by Yves Younan of Cisco Talos (TALOS-CAN-0141)
* Fixed a remote out-of-bounds write vulnerability. Discovered by Yves
Younan of Cisco Talos. (TALOS-CAN-0139)
* Fix a remote out-of-bounds read. Discovered by Yves Younan of Cisco
Talos. (TALOS-CAN-0143)
version 2.10.12 (12/31/2015):
General:
* purple-url-handler now works with Python 3.x (Daniël van Eeden)
* Fixed an issue where transient startup statuses could be deleted
(Jakub Adam) (#16762)
Pidgin:
* The shout smile now matches the default theme (Steve Vaught)
Windows-Specific Changes:
* Updates to dependencies:
* Cyrus SASL 2.1.26
* libxml2 2.9.2
* NSS 3.20.1 and NSPR 4.10.10
* Perl 5.20.1
* SILC 1.1.12
* Remove support for Tcl plugins
Gadu-Gadu:
* Updated internal libgadu to version 1.12.1.
version 2.10.11 (11/23/2014):
General:
* Fix handling of Self-Signed SSL/TLS Certificates when using the NSS
plugin (#16412)
* Improve default cipher suites used with the NSS plugin (#16262)
* Add NSS Preferences plugin which allows the SSL/TLS Versions and
cipher suites to be configured (#8061)
Gadu-Gadu:
* Fix a bug that prevented plugin to load when compiled without GnuTLS.
(mancha) (#16431)
* Fix build for platforms without AF_LOCAL definition. (#16404)
MSN:
* Fix broken login due to server change (dx, TReKiE). (#16451, #16455)
* Fail early when buddy list is unavailable instead of wasting bandwidth
endlessly re-trying.
version 2.10.10 (10/22/2014):
General:
* Check the basic constraints extension when validating SSL/TLS
certificates. This fixes a security hole that allowed a malicious
man-in-the-middle to impersonate an IM server or any other https
endpoint. This affected both the NSS and GnuTLS plugins. (Discovered
by an anonymous person and Jacob Appelbaum of the Tor Project, with
thanks to Moxie Marlinspike for first publishing about this type of
vulnerability. Thanks to Kai Engert for guidance and for some of the
NSS changes) (CVE-2014-3694)
* Allow and prefer TLS 1.2 and 1.1 when using the NSS plugin for SSL.
(Elrond and Ashish Gupta) (#15909)
libpurple3 compatibility:
* Encrypted account passwords are preserved until the new one is set.
* Fix loading Google Talk and Facebook XMPP accounts.
Windows-Specific Changes:
* Don't allow overwriting arbitrary files on the file system when the
user installs a smiley theme via drag-and-drop. (Discovered by Yves
Younan of Cisco Talos) (CVE-2014-3697)
* Updates to dependencies:
* NSS 3.17.1 and NSPR 4.10.7
Finch:
* Fix build against Python 3. (Ed Catmur) (#15969)
Gadu-Gadu:
* Updated internal libgadu to version 1.12.0.
Groupwise:
* Fix potential remote crash parsing server message that indicates that
a large amount of memory should be allocated. (Discovered by Yves Younan
and Richard Johnson of Cisco Talos) (CVE-2014-3696)
IRC:
* Fix a possible leak of unencrypted data when using /me command
with OTR. (Thijs Alkemade) (#15750)
MXit:
* Fix potential remote crash parsing a malformed emoticon response.
(Discovered by Yves Younan and Richard Johnson of Cisco Talos)
(CVE-2014-3695)
XMPP:
* Fix potential information leak where a malicious XMPP server and
possibly even a malicious remote user could create a carefully crafted
XMPP message that causes libpurple to send an XMPP message containing
arbitrary memory. (Discovered and fixed by Thijs Alkemade and Paul
Aurich) (CVE-2014-3698)
* Fix Facebook XMPP roster quirks. (#15041, #15957)
Yahoo:
* Fix login when using the GnuTLS library for TLS connections. (#16172)
version 2.10.9 (2/2/2014):
XMPP:
* Fix problems logging into some servers including jabber.org and
chat.facebook.com. (#15879)
version 2.10.8 (1/28/2014):
General:
* Python build scripts and example plugins are now compatible with
Python 3. (Ashish Gupta) (#15624)
libpurple:
* Fix potential crash if libpurple gets an error attempting to read a
reply from a STUN server. (Discovered by Coverity static analysis)
(CVE-2013-6484)
* Fix potential crash parsing a malformed HTTP response. (Discovered by
Jacob Appelbaum of the Tor Project) (CVE-2013-6479)
* Fix buffer overflow when parsing a malformed HTTP response with
chunked Transfer-Encoding. (Discovered by Matt Jones, Volvent)
(CVE-2013-6485)
* Better handling of HTTP proxy responses with negative Content-Lengths.
(Discovered by Matt Jones, Volvent)
* Fix handling of SSL certificates without subjects when using libnss.
* Fix handling of SSL certificates with timestamps in the distant future
when using libnss. (#15586)
* Impose maximum download size for all HTTP fetches.
Pidgin:
* Fix crash displaying tooltip of long URLs. (CVE-2013-6478)
* Better handling of URLs longer than 1000 letters.
* Fix handling of multibyte UTF-8 characters in smiley themes. (#15756)
Windows-Specific Changes:
* When clicking file:// links, show the file in Explorer rather than
attempting to run the file. This reduces the chances of a user
clicking on a link and mistakenly running a malicious file.
(Originally discovered by James Burton, Insomnia Security. Rediscovered
by Yves Younan of Sourcefire VRT.) (CVE-2013-6486)
* Fix Tcl scripts. (#15520)
* Fix crash-on-startup when ASLR is always on. (#15521)
* Updates to dependencies:
* NSS 3.15.4 and NSPR 4.10.2
* Pango 1.29.4-1daa
Patched for https://bugzilla.gnome.org/show_bug.cgi?id=668154
AIM:
* Fix untrusted certificate error.
AIM and ICQ:
* Fix a possible crash when receiving a malformed message in a Direct IM
session.
Gadu-Gadu:
* Fix buffer overflow with remote code execution potential. Only
triggerable by a Gadu-Gadu server or a man-in-the-middle.
(Discovered by Yves Younan and Ryan Pentney of Sourcefire VRT)
(CVE-2013-6487)
* Disabled buddy list import/export from/to server (it didn't work
anymore). Buddy list synchronization will be implemented in 3.0.0.
* Disabled new account registration and password change options, as it
didn't work either. Account registration also caused a crash. Both
functions are available using official Gadu-Gadu website.
IRC:
* Fix bug where a malicious server or man-in-the-middle could trigger
a crash by not sending enough arguments with various messages.
(Discovered by Daniel Atallah) (CVE-2014-0020)
* Fix bug where initial IRC status would not be set correctly.
* Fix bug where IRC wasn't available when libpurple was compiled with
Cyrus SASL support. (#15517)
MSN:
* Fix NULL pointer dereference parsing headers in MSN.
(Discovered by Fabian Yamaguchi and Christian Wressnegger of the
University of Goettingen) (CVE-2013-6482)
* Fix NULL pointer dereference parsing OIM data in MSN.
(Discovered by Fabian Yamaguchi and Christian Wressnegger of the
University of Goettingen) (CVE-2013-6482)
* Fix NULL pointer dereference parsing SOAP data in MSN.
(Discovered by Fabian Yamaguchi and Christian Wressnegger of the
University of Goettingen) (CVE-2013-6482)
* Fix possible crash when sending very long messages. Not
remotely-triggerable. (Discovered by Matt Jones, Volvent)
MXit:
* Fix buffer overflow with remote code execution potential.
(Discovered by Yves Younan and Pawel Janic of Sourcefire VRT)
(CVE-2013-6489)
* Fix sporadic crashes that can happen after user is disconnected.
* Fix crash when attempting to add a contact via search results.
* Show error message if file transfer fails.
* Fix compiling with InstantBird.
* Fix display of some custom emoticons.
SILC:
* Correctly set whiteboard dimensions in whiteboard sessions.
SIMPLE:
* Fix buffer overflow with remote code execution potential.
(Discovered by Yves Younan of Sourcefire VRT) (CVE-2013-6490)
XMPP:
* Prevent spoofing of iq replies by verifying that the 'from' address
matches the 'to' address of the iq request. (Discovered by Fabian
Yamaguchi and Christian Wressnegger of the University of Goettingen,
fixed by Thijs Alkemade) (CVE-2013-6483)
* Fix crash on some systems when receiving fake delay timestamps with
extreme values. (Discovered by Jaime Breva Ribes) (CVE-2013-6477)
* Fix possible crash or other erratic behavior when selecting a very
small file for your own buddy icon.
* Fix crash if the user tries to initiate a voice/video session with a
resourceless JID.
* Fix login errors when the first two available auth mechanisms fail but
a subsequent mechanism would otherwise work when using Cyrus SASL.
(#15524)
* Fix dropping incoming stanzas on BOSH connections when we receive
multiple HTTP responses at once. (Issa Gorissen) (#15684)
Yahoo!:
* Fix possible crashes handling incoming strings that are not UTF-8.
(Discovered by Thijs Alkemade and Robert Vehse) (CVE-2012-6152)
* Fix a bug reading a peer to peer message where a remote user could
trigger a crash. (CVE-2013-6481)
Plugins:
* Fix crash in contact availability plugin.
* Fix perl function Purple::Network::ip_atoi
* Add Unity integration plugin.
version 2.10.7 (02/13/2013):
Alien hatchery:
* No changes
General:
* The configure script will now exit with status 1 when specifying
invalid protocol plugins using the --with-static-prpls and
--with-dynamic-prpls arguments. (Michael Fiedler) (#15316)
libpurple:
* Fix a crash when receiving UPnP responses with abnormally long values.
(CVE-2013-0274)
* Don't link directly to libgcrypt when building with GnuTLS support.
(Bartosz Brachaczek) (#15329)
* Fix UPnP mappings on routers that return empty <URLBase/> elements
in their response. (Ferdinand Stehle) (#15373)
* Tcl plugin uses saner, race-free plugin loading.
* Fix the Tcl signals-test plugin for savedstatus-changed.
(Andrew Shadura) (#15443)
Pidgin:
* Make Pidgin more friendly to non-X11 GTK+, such as MacPorts' +no_x11
variant.
Gadu-Gadu:
* Fix a crash at startup with large contact list. Avatar support for
buddies will be disabled until 3.0.0. (#15226, #14305)
IRC:
* Support for SASL authentication. (Thijs Alkemade, Andy Spencer)
(#13270)
* Print topic setter information at channel join. (#13317)
MSN:
* Fix SSL certificate issue when signing into MSN for some users.
* Fix a crash when removing a user before its icon is loaded. (Mark
Barfield) (#15217)
MXit:
* Fix two bugs where a remote MXit user could possibly specify a local
file path to be written to. (CVE-2013-0271)
* Fix a bug where the MXit server or a man-in-the-middle could
potentially send specially crafted data that could overflow a buffer
and lead to a crash or remote code execution. (CVE-2013-0272)
* Display farewell messages in a different colour to distinguish
them from normal messages.
* Add support for typing notification.
* Add support for the Relationship Status profile attribute.
* Remove all reference to Hidden Number.
* Ignore new invites to join a GroupChat if you're already joined, or
still have a pending invite.
* The buddy's name was not centered vertically in the buddy-list if they
did not have a status-message or mood set.
* Fix decoding of font-size changes in the markup of received messages.
* Increase the maximum file size that can be transferred to 1 MB.
* When setting an avatar image, no longer downscale it to 96x96.
Sametime:
* Fix a crash in Sametime when a malicious server sends us an abnormally
long user ID. (CVE-2013-0273)
Yahoo!:
* Fix a double-free in profile/picture loading code. (Mihai Serban)
(#15053)
* Fix retrieving server-side buddy aliases. (Catalin Salgau) (#15381)
Plugins:
* The Voice/Video Settings plugin supports using the sndio GStreamer
backends. (Brad Smith) (#14414)
* Fix a crash in the Contact Availability Detection plugin. (Mark)
(#15327)
* Make the Message Notification plugin more friendly to non-X11 GTK+,
such as MacPorts' +no_x11 variant.
Windows-Specific Changes:
* Compile with secure flags (Jurre van Bergen) (#15290)
* Installer downloads GTK+ Runtime and Debug Symbols more securely.
Thanks goes to Jacob Appelbaum of the Tor Project for identifying
this issue and suggesting solutions. (#15277)
* Updates to a number of dependencies, some of which have security
related fixes. Thanks again to Jacob Appelbaum and Jurre van Bergen
for identifying the vulnerable libraries and to Dieter Verfaillie
for helping getting the libraries updated. (#14571, #15285, #15286)
* ATK 1.32.0-2
* Cyrus SASL 2.1.25
* expat 2.1.0-1
* freetype 2.4.10-1
* gettext 0.18.1.1-2
* Glib 2.28.8-1
* libpng 1.4.12-1
* libxml2 2.9.0-1
* NSS 3.13.6 and NSPR 4.9.2
* Pango 1.29.4-1
* SILC 1.1.10
* zlib 1.2.5-2
* Patch libmeanwhile (sametime library) to fix crash. (Jonathan Rice)
(#12637)
version 2.10.6 (07/06/2012):
Pidgin:
* Fix a bug that requires a triple-click to open a conversation
window from the buddy list. (#15199)
version 2.10.5 (07/05/2012):
libpurple:
* Add support for GNOME3 proxy settings. (Mihai Serban) (#15054)
Pidgin:
* Fix a crash that may occur when trying to ignore a user who is
not in the current chat room. (#15139)
MSN:
* Fix building with MSVC on Windows (broken in 2.10.4). (Florian
Quèze)
MXit:
* Fix a buffer overflow vulnerability when parsing incoming messages
containing inline images. Thanks to Ulf Härnhammar for reporting
this! (CVE-2012-3374)
version 2.10.4 (05/06/2012):
General:
* Support building against Farstream in addition to Farsight.
(Olivier Crete) (#14936)
IRC:
* Disable periodic WHO timer. IRC channel user lists will no
longer automatically display away status, but libpurple will be
much kinder to the network.
* Print unknown numerics to channel windows if we can associate
them. Thanks to Marien Zwart. (#15090)
MSN:
* Fix a possible crash when receiving messages with certain characters
or character encodings. Thanks to Fabian Yamaguchi for reporting
this! (CVE-2012-2318)
XMPP:
* Fix a possible crash when receiving a series of specially crafted
file transfer requests. Thanks to José Valentín Gutiérrez for
reporting this! (CVE-2012-2214)
Windows-Specific Changes:
* Words added to spell check dictionaries are saved across restarts of
Pidgin (#11886)
version 2.10.3 (03/26/2012):
MSN:
* Fix buddies not going offline. (#14997)
version 2.10.2 (03/14/2012):
General:
* Fix compilation when using binutils 2.22 and new GDK pixbuf. (#14799)
* Fix compilation of the MXit protocol plugin with GLib 2.31. (#14773)
Pidgin:
* Add support for the GNOME3 Network dialog. (#13882)
* Fix rare crash. (#14392)
* Add support for the GNOME3 Default Application dialog for configuring
the Browser.
libpurple:
* Support new connection states and signals for NetworkManager 0.9+.
(Dan Williams) (#13859)
AIM and ICQ:
* Fix a possible crash when receiving an unexpected message
from the server. (Thijs Alkemade) (#14983)
* Allow signing on with usernames containing periods and
underscores. (#13500)
* Allow adding buddies containing periods and underscores. (#13500)
* Don't try to format ICQ usernames entered as email addresses.
Gets rid of an "Unable to format username" error at login. (#13883)
MSN:
* Fix possible crashes caused by not validating incoming messages as
UTF-8. (Thijs Alkemade) (#14884)
* Support new protocol version MSNP18. (#14753)
* Fix messages to offline contacts. (#14302)
Windows-Specific Changes:
* Fix the installer downloading of spell-checking dictionaries (#14612)
* Fix compilation of the Bonjour protocol plugin. (#14802)
Plugins:
* The autoaccept plugin will no longer reset the preference for unknown
buddies to "Auto Reject" in certain cases. (#14964)
version 2.10.1 (12/06/2011):
Finch:
* Fix compilation on OpenBSD.
AIM and ICQ:
* Fix remotely-triggerable crashes by validating strings in a few
messages related to buddy list management. Thanks to Evgeny Boger
for reporting this! (#14682)
Bonjour:
* IPv6 fixes (Linus Lüssing)
Gadu-Gadu:
* Fix problems linking against GnuTLS. (#14544)
IRC:
* Fix a memory leak when admitting UTF-8 text with a non-UTF-8 primary
encoding. (#14700)
Jabber:
* Fix crashes and memory leaks when receiving malformed voice
and video requests. Thanks to Thijs Alkemade for reporting this!
Sametime:
* Separate "username" and "server" when adding new Sametime accounts.
(#14608)
* Fix compilation in Visual C++. (#14608)
SILC:
* Fix CVE-2011-3594, by UTF-8 validating incoming messages before
passing them to glib or libpurple. Identified by Diego Bauche
Madero from IOActive. (#14636)
Yahoo!:
* Fetch buddy icons in some cases where we previously weren't. (#13050)
Windows-Specific Changes:
* Fix compilation
version 2.10.0 (08/18/2011):
Pidgin:
* Make the max size of incoming smileys a pref instead of hardcoding it.
(Quentin Brandon) (#5231)
* Added a plugin information dialog to show information for plugins
that aren't otherwise visible in the plugins dialog.
* Fix building with GTK+ earlier than 2.14.0 (GTK+ 2.10 is still the
minimum supported) (#14261)
libpurple:
* Fix a potential crash in the Log Reader plugin when reading QIP logs.
* Fix a large number of strcpy() and strcat() invocations to use
strlcpy() and strlcat(), etc., forestalling an entire class of
string buffer overrun bugs.
(The Electronic Frontier Foundation, Dan Auerbach, Chris Palmer,
Jacob Appelbaum)
* Change some filename manipulations in filectl.c to use MAXPATHLEN
instead of arbitrary length constants. (The Electronic Frontier
Foundation, Dan Auerbach, Chris Palmer, Jacob Appelbaum)
* Fix endianness-related crash in NTLM authentication (Jon Goldberg)
(#14163)
Gadu-Gadu:
* Fixed searching for buddies in public directory. (Tomasz Wasilczyk)
(#5242)
* Better status message handling. (Tomasz Wasilczyk) (#14314)
* Merged two buddy blocking methods. (Tomasz Wasilczyk) (#5303)
* Fix building of the bundled libgadu library with older versions
of GnuTLS. (patch plucked from upstream) (#14365)
ICQ:
* Fix crash selecting Tools->Set Mood when you're online with an
ICQ account that is configured as an AIM account. (#14437)
IRC:
* Fix a crash when remote users have certain characters in their
nicknames. (Discovered by Djego Ibanez) (#14341)
* Fix the handling of formatting following mIRC ^O (#14436)
* Fix crash when NAMES is empty. (James McLaughlin) (#14518)
MSN:
* Fix incorrect handling of HTTP 100 responses when using the HTTP
connection method. This can lead to a crash. (Discovered by Marius
Wachtler)
* Fix seemingly random crashing. (#14307)
* Fix a crash when the account is disconnected at the time we are doing a
SB request. (Hanzz, ported by shlomif) (#12431)
XMPP:
* Do not generate malformed XML ("</>") when setting an empty mood.
(#14342)
* Fix the /join <room> behavior. (Broken when adding support for
<room>@<server>) (#14205)
Yahoo!/Yahoo! JAPAN:
* Fix coming out of idle while in an unavailable state
* Fix logging into Yahoo! JAPAN. (#14259)
Windows-Specific Changes:
* Open an explorer.exe window at the location of the file when clicking
on a file link instead of executing the file, because executing a file
can be potentially dangerous. (Discovered by James Burton of
Insomnia Security) (Fixed by Eion Robb)
version 2.9.0 (06/23/2011):
Pidgin:
* Fix a potential remote denial-of-service bug related to displaying
buddy icons.
* Significantly improved performance of larger IRC channels (regression
introduced in 2.8.0).
* Fix Conversation->Add on AIM and MSN.
* Entries in the chat user list are sorted properly again. This was
inadvertenly broken in 2.8.0.
Finch:
* Fix logging in to ICQ.
libpurple:
* media: Actually use the specified TCP port from the TURN configuration to
create a TCP relay candidate.
AIM and ICQ:
* Fix crashes on some non-mainstream OSes when attempting to
printf("%s", NULL). (Clemens Huebner) (#14297)
Plugins:
* The Evolution Integration plugin compiles again.
version 2.8.0 (06/07/2011):
General:
* Implement simple silence suppression for voice calls, preventing
wasted bandwidth for silent periods during a call. (Jakub Adam)
(half of #13180)
* Added the DigiCert High Assurance CA-3 intermediate CA, needed for
validation of the Facebook XMPP interface's certificate.
* Removed the QQ protocol plugin. It hasn't worked in a long time and