Published: 07/07/2008 Updated: 13/02/2023

CVSS v2 Base Score: 6.8 | Impact Score: 6.4 | Exploitability Score: 8.6

VMScore: 605

Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P

Multiple integer overflows in the msn_slplink_process_msg functions in the MSN protocol handler in (1) libpurple/protocols/msn/slplink.c and (2) libpurple/protocols/msnp9/slplink.c in Pidgin prior to 2.4.3 and Adium prior to 1.3 allow remote malicious users to execute arbitrary code via a malformed SLP message with a crafted offset value, a different vulnerability than CVE-2008-2955.

Vulnerable Product	Search on Vulmon	Subscribe to Product
pidgin pidgin 2.1.0
pidgin pidgin 2.0.1
pidgin pidgin 2.2.2
pidgin pidgin 2.1.1
pidgin pidgin 2.3.1
pidgin pidgin 2.0.0
pidgin pidgin 2.0.2
pidgin pidgin 2.3.0
pidgin pidgin 2.4.1
pidgin pidgin 2.4.0
pidgin pidgin 2.2.0
pidgin pidgin
pidgin pidgin 2.2.1
adium adium 1.0.2
adium adium 1.1
adium adium 1.0.1
adium adium 1.0.5
adium adium 1.1.2
adium adium 1.1.3
adium adium 1.1.4
adium adium 1.0.4
adium adium
adium adium 1.0
adium adium 1.0.3
adium adium 1.1.1

Debian Bug report logs - #488632 pidgin: Few security flaws Package: pidgin; Maintainer for pidgin is Ari Pollak <ari@debianorg>; Source for pidgin is src:pidgin (PTS, buildd, popcon) Reported by: Steffen Joeris <steffenjoeris@skolelinuxde> Date: Mon, 30 Jun 2008 08:36:02 UTC Severity: important Tags: fixed-upstr ...

Synopsis Important: pidgin security update Type/Severity Security Advisory: Important Topic An updated pidgin package that fixes two security issues is now availablefor Red Hat Enterprise Linux 3This update has been rated as having important security impact by the RedHat Security Response Team De ...

Synopsis Important: pidgin security update Type/Severity Security Advisory: Important Topic Updated pidgin packages that fix several security issues are now availablefor Red Hat Enterprise Linux 4 and 5This update has been rated as having important security impact by the RedHat Security Response Team ...

It was discovered that Gaim did not properly handle certain malformed messages in the MSN protocol handler A remote attacker could send a specially crafted message and possibly execute arbitrary code with user privileges (CVE-2008-2927) ...

It was discovered that Pidgin did not properly handle certain malformed messages in the MSN protocol handler A remote attacker could send a specially crafted message and possibly execute arbitrary code with user privileges (CVE-2008-2927) ...

Federico Muttis discovered that libpurple, the shared library that adds support for various instant messaging networks to the pidgin IM client, is vulnerable to a heap-based buffer overflow This issue exists because of an incomplete fix for CVE-2008-2927 and CVE-2009-1376 An attacker can exploit this by sending two consecutive SLP packets to a vi ...

Several vulnerabilities have been discovered in Pidgin, a graphical multi-protocol instant messaging client The Common Vulnerabilities and Exposures project identifies the following problems: CVE-2009-1373 A buffer overflow in the Jabber file transfer code may lead to denial of service or the execution of arbitrary code CVE-2009-1375 ...

It was discovered that gaim, an multi-protocol instant messaging client, was vulnerable to several integer overflows in its MSN protocol handlers These could allow a remote attacker to execute arbitrary code For the stable distribution (etch), this problem has been fixed in version 1:200+beta5-10etch1 For the unstable distribution (sid), this ...

CWE-189 http://www.openwall.com/lists/oss-security/2008/07/04/1 http://www.openwall.com/lists/oss-security/2008/07/03/6 http://developer.pidgin.im/viewmtn/revision/diff/6eb1949a96fa80a4c744fc749c2562abc4cc9ed6/with/c3831c9181f4f61b747321240086ee79e4a08fd8/libpurple/protocols/msn/slplink.c http://developer.pidgin.im/viewmtn/revision/diff/6eb1949a96fa80a4c744fc749c2562abc4cc9ed6/with/c3831c9181f4f61b747321240086ee79e4a08fd8/libpurple/protocols/msnp9/slplink.c https://bugzilla.redhat.com/show_bug.cgi?id=453764 http://www.mandriva.com/security/advisories?name=MDVSA-2008:143 http://secunia.com/advisories/31387 http://www.debian.org/security/2008/dsa-1610 http://secunia.com/advisories/31016 http://www.securityfocus.com/archive/1/493682 http://secunia.com/advisories/31105 http://secunia.com/advisories/30971 http://www.pidgin.im/news/security/?id=25 http://wiki.rpath.com/wiki/Advisories:rPSA-2008-0246 http://www.zerodayinitiative.com/advisories/ZDI-08-054 http://www.redhat.com/support/errata/RHSA-2008-0584.html https://issues.rpath.com/browse/RPL-2647 http://www.securityfocus.com/bid/29956 http://secunia.com/advisories/31642 http://www.securitytracker.com/id?1020451 http://www.mandriva.com/security/advisories?name=MDVSA-2009:127 http://www.vupen.com/english/advisories/2008/2032/references http://secunia.com/advisories/32861 http://secunia.com/advisories/32859 http://www.ubuntu.com/usn/USN-675-1 http://www.ubuntu.com/usn/USN-675-2 https://exchange.xforce.ibmcloud.com/vulnerabilities/44774 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A17972 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11695 http://www.securityfocus.com/archive/1/495818/100/0/threaded http://www.securityfocus.com/archive/1/495165/100/0/threaded https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=488632 https://nvd.nist.gov https://usn.ubuntu.com/675-2/

Get Started

CVE-2008-2927

Vulnerability Summary

Vendor Advisories

References

Vulmon Search

About

Products

Connect