Published: 26/05/2009 Updated: 07/11/2023

CVSS v2 Base Score: 7.1 | Impact Score: 10 | Exploitability Score: 3.9

VMScore: 632

Vector: AV:N/AC:H/Au:S/C:C/I:C/A:C

Buffer overflow in the XMPP SOCKS5 bytestream server in Pidgin (formerly Gaim) prior to 2.5.6 allows remote authenticated users to execute arbitrary code via vectors involving an outbound XMPP file transfer. NOTE: some of these details are obtained from third party information.

Vulnerable Product	Search on Vulmon	Subscribe to Product
pidgin pidgin 2.1.0
pidgin pidgin 2.5.2
pidgin pidgin 2.5.1
pidgin pidgin 2.0.1
pidgin pidgin 2.4.2
pidgin pidgin 2.5.4
pidgin pidgin 2.2.2
pidgin pidgin 2.1.1
pidgin pidgin 2.3.1
pidgin pidgin 2.4.3
pidgin pidgin 2.0.0
pidgin pidgin 2.0.2
pidgin pidgin 2.3.0
pidgin pidgin 2.4.1
pidgin pidgin 2.4.0
pidgin pidgin
pidgin pidgin 2.5.0
pidgin pidgin 2.2.0
pidgin pidgin 2.2.1
pidgin pidgin 2.5.3

Synopsis Important: pidgin security update Type/Severity Security Advisory: Important Topic Updated pidgin packages that fix several security issues are now availablefor Red Hat Enterprise Linux 4 and 5This update has been rated as having important security impact by the RedHat Security Response Team ...

Synopsis Important: pidgin security update Type/Severity Security Advisory: Important Topic An updated pidgin package that fixes two security issues is now availablefor Red Hat Enterprise Linux 3This update has been rated as having important security impact by the RedHat Security Response Team De ...

It was discovered that Gaim did not properly handle certain malformed messages when sending a file using the XMPP protocol handler If a user were tricked into sending a file, a remote attacker could send a specially crafted response and cause Gaim to crash, or possibly execute arbitrary code with user privileges (CVE-2009-1373) ...

It was discovered that Pidgin did not properly handle certain malformed messages when sending a file using the XMPP protocol handler If a user were tricked into sending a file, a remote attacker could send a specially crafted response and cause Pidgin to crash, or possibly execute arbitrary code with user privileges (CVE-2009-1373) ...

Several vulnerabilities have been discovered in Pidgin, a graphical multi-protocol instant messaging client The Common Vulnerabilities and Exposures project identifies the following problems: CVE-2009-1373 A buffer overflow in the Jabber file transfer code may lead to denial of service or the execution of arbitrary code CVE-2009-1375 ...

CWE-119 http://www.redhat.com/support/errata/RHSA-2009-1059.html http://www.securityfocus.com/bid/35067 https://bugzilla.redhat.com/show_bug.cgi?id=500488 http://secunia.com/advisories/35202 http://secunia.com/advisories/35194 http://www.pidgin.im/news/security/?id=29 http://www.redhat.com/support/errata/RHSA-2009-1060.html http://secunia.com/advisories/35215 http://debian.org/security/2009/dsa-1805 http://www.vupen.com/english/advisories/2009/1396 http://secunia.com/advisories/35188 http://www.gentoo.org/security/en/glsa/glsa-200905-07.xml https://www.redhat.com/archives/fedora-package-announce/2009-June/msg00075.html http://www.ubuntu.com/usn/USN-781-1 https://www.redhat.com/archives/fedora-package-announce/2009-June/msg00051.html https://www.redhat.com/archives/fedora-package-announce/2009-June/msg00033.html http://www.ubuntu.com/usn/USN-781-2 http://secunia.com/advisories/35294 http://secunia.com/advisories/35330 http://secunia.com/advisories/35329 http://www.mandriva.com/security/advisories?name=MDVSA-2009:140 http://www.mandriva.com/security/advisories?name=MDVSA-2009:173 https://exchange.xforce.ibmcloud.com/vulnerabilities/50682 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9005 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A17722 https://access.redhat.com/errata/RHSA-2009:1060 https://nvd.nist.gov https://usn.ubuntu.com/781-2/

CVE-2009-1373

Vulnerability Summary

Vendor Advisories

References

Vulmon Search

About

Products

Connect