Published: 26/05/2009 Updated: 07/11/2023

CVSS v2 Base Score: 9.3 | Impact Score: 10 | Exploitability Score: 8.6

VMScore: 935

Vector: AV:N/AC:M/Au:N/C:C/I:C/A:C

Multiple integer overflows in the msn_slplink_process_msg functions in the MSN protocol handler in (1) libpurple/protocols/msn/slplink.c and (2) libpurple/protocols/msnp9/slplink.c in Pidgin (formerly Gaim) prior to 2.5.6 on 32-bit platforms allow remote malicious users to execute arbitrary code via a malformed SLP message with a crafted offset value, leading to buffer overflows. NOTE: this issue exists because of an incomplete fix for CVE-2008-2927.

Vulnerable Product	Search on Vulmon	Subscribe to Product
pidgin pidgin 2.5.2
pidgin pidgin 2.5.3
pidgin pidgin 2.5.0
pidgin pidgin 2.4.2
pidgin pidgin
pidgin pidgin 2.4.0
pidgin pidgin 2.4.3
pidgin pidgin 2.5.4
pidgin pidgin 2.4.1

Synopsis Important: pidgin security update Type/Severity Security Advisory: Important Topic An updated pidgin package that fixes two security issues is now availablefor Red Hat Enterprise Linux 3This update has been rated as having important security impact by the RedHat Security Response Team De ...

Synopsis Important: pidgin security update Type/Severity Security Advisory: Important Topic Updated pidgin packages that fix several security issues are now availablefor Red Hat Enterprise Linux 4 and 5This update has been rated as having important security impact by the RedHat Security Response Team ...

It was discovered that Pidgin did not properly handle certain topic messages in the IRC protocol handler If a user were tricked into connecting to a malicious IRC server, an attacker could cause Pidgin to crash, leading to a denial of service This issue only affected Ubuntu 804 LTS, Ubuntu 810 and Ubuntu 904 (CVE-2009-2703) ...

It was discovered that Gaim did not properly handle certain malformed messages when sending a file using the XMPP protocol handler If a user were tricked into sending a file, a remote attacker could send a specially crafted response and cause Gaim to crash, or possibly execute arbitrary code with user privileges (CVE-2009-1373) ...

It was discovered that Pidgin did not properly handle certain malformed messages when sending a file using the XMPP protocol handler If a user were tricked into sending a file, a remote attacker could send a specially crafted response and cause Pidgin to crash, or possibly execute arbitrary code with user privileges (CVE-2009-1373) ...

Federico Muttis discovered that libpurple, the shared library that adds support for various instant messaging networks to the pidgin IM client, is vulnerable to a heap-based buffer overflow This issue exists because of an incomplete fix for CVE-2008-2927 and CVE-2009-1376 An attacker can exploit this by sending two consecutive SLP packets to a vi ...

Several vulnerabilities have been discovered in Pidgin, a graphical multi-protocol instant messaging client The Common Vulnerabilities and Exposures project identifies the following problems: CVE-2009-1373 A buffer overflow in the Jabber file transfer code may lead to denial of service or the execution of arbitrary code CVE-2009-1375 ...

/* * Pidgin MSN <= 258 Remote Code Execution * * Pierre Nogues - pierz@hotmailit * wwwindahaxcom/ * * * Description: * Pidgin is a multi-protocol Instant Messenger * * This is an exploit for the vulnerability[1] discovered in Pidgin by core-security[2] * The library "libmsn" used by pidgin doesn't handle specia ...

CVE-2009-1376

Vulnerability Summary

Vendor Advisories

Exploits

References

Vulmon Search

About

Products

Connect