Published: 01/07/2009 Updated: 29/09/2017

CVSS v2 Base Score: 5 | Impact Score: 2.9 | Exploitability Score: 10

VMScore: 445

Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P

The OSCAR protocol implementation in Pidgin prior to 2.5.8 misinterprets the ICQWebMessage message type as the ICQSMS message type, which allows remote malicious users to cause a denial of service (application crash) via a crafted ICQ web message that triggers allocation of a large amount of memory.

Vulnerable Product	Search on Vulmon	Subscribe to Product
pidgin pidgin 2.0.2
pidgin pidgin 2.4.0
pidgin pidgin 2.4.1
pidgin pidgin 2.5.1
pidgin pidgin 2.5.3
pidgin pidgin 2.1.0
pidgin pidgin 2.2.1
pidgin pidgin 2.5.2
pidgin pidgin 2.5.6
pidgin pidgin 2.3.1
pidgin pidgin 2.5.4
pidgin pidgin 2.0.0
pidgin pidgin 2.2.0
pidgin pidgin 2.4.2
pidgin pidgin 2.3.0
pidgin pidgin 2.5.5
pidgin pidgin 2.1.1
pidgin pidgin 2.0.1
pidgin pidgin 2.2.2
pidgin pidgin 2.4.3
pidgin pidgin 2.5.0
pidgin pidgin

Synopsis Moderate: pidgin security and bug fix update Type/Severity Security Advisory: Moderate Topic Updated pidgin packages that fix one security issue and one bug are nowavailable for Red Hat Enterprise Linux 4 and 5This update has been rated as having moderate security impact by the RedHat Security Res ...

Debian Bug report logs - #535790 pidgin: CVE-2009-1889 denial-of-service Package: pidgin; Maintainer for pidgin is Ari Pollak <ari@debianorg>; Source for pidgin is src:pidgin (PTS, buildd, popcon) Reported by: "Michael S Gilbert" <michaelsgilbert@gmailcom> Date: Sun, 5 Jul 2009 03:48:01 UTC Severity: important ...

Yuriy Kaminskiy discovered that Pidgin did not properly handle certain messages in the ICQ protocol handler A remote attacker could send a specially crafted message and cause Pidgin to crash ...

CWE-399 http://www.securityfocus.com/bid/35530 https://bugzilla.redhat.com/show_bug.cgi?id=508738 http://pidgin.im/pipermail/devel/2009-May/008227.html http://developer.pidgin.im/ticket/9483 https://www.redhat.com/archives/fedora-package-announce/2009-July/msg00228.html http://secunia.com/advisories/35697 http://www.ubuntu.com/usn/USN-796-1 https://www.redhat.com/archives/fedora-package-announce/2009-July/msg00176.html https://www.redhat.com/archives/fedora-package-announce/2009-July/msg00162.html http://secunia.com/advisories/35706 http://secunia.com/advisories/35693 http://www.vupen.com/english/advisories/2009/1749 http://www.redhat.com/support/errata/RHSA-2009-1139.html http://secunia.com/advisories/37071 https://exchange.xforce.ibmcloud.com/vulnerabilities/51448 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10004 https://access.redhat.com/errata/RHSA-2009:1139 https://usn.ubuntu.com/796-1/https://nvd.nist.gov

CVE-2009-1889

Vulnerability Summary

Vulnerability Trend

Vendor Advisories

References

Vulmon Search

About

Products

Connect