pidgin: CVE-2009-2694 Libpurple msn_slplink_process_msg() Arbitrary Write Vulnerability

Debian Bug report logs - #542486
pidgin: CVE-2009-2694 Libpurple msn_slplink_process_msg() Arbitrary Write Vulnerability

Toggle useless messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Josue Abarca <jmaslibre@debian.org.gt>

To: submit@bugs.debian.org

Subject: pidgin: CVE-2009-2694 Libpurple msn_slplink_process_msg() Arbitrary Write Vulnerability

Date: Wed, 19 Aug 2009 15:22:26 -0600

Package: pidgin
Version: 2.4.3-4lenny2
Severity: normal
Tags: security


Hi,
the following CVE (Common Vulnerabilities & Exposures) id was
published for pidgin.


CVE-2009-2694[0]:
| A remote arbitrary-code-execution vulnerability has been found in
| Libpurple (used by Pidgin and Adium instant messaging clients, among
| others), which can be triggered by a remote attacker by sending a
| specially crafted MSNSLP packet  [4] with invalid data to the client
| through the MSN server. No victim interaction is required, and the
| attacker is not required to be in the victim's buddy list (under
| default configuration).

This bug is fixed in pidgin 2.5.9 [1]


Thanks for your work.

[0] http://www.coresecurity.com/content/libpurple-arbitrary-write
[1] http://pidgin.im/news/security/?id=34

Message #12 received at 542486-done@bugs.debian.org (full text, mbox, reply):

From: Nico Golde <nion@debian.org>

To: Josue Abarca <jmaslibre@debian.org.gt>, 542486-done@bugs.debian.org

Subject: Re: Bug#542486: pidgin: CVE-2009-2694 Libpurple msn_slplink_process_msg() Arbitrary Write Vulnerability

Date: Thu, 20 Aug 2009 00:49:29 +0200

[Message part 1 (text/plain, inline)]

Version: 2.5.9-1

[Message part 2 (application/pgp-signature, inline)]

Send a report that this bug log contains spam.