CVE-2009-1376

pidgin incomplete fix for CVE-2008-2927

Published May 26, 2009 CVSS 2.0 · 9.3 Critical EPSS 13.3% KEV · Not listed
Description
Multiple integer overflows in the msn_slplink_process_msg functions in the MSN protocol handler in (1) libpurple/protocols/msn/slplink.c and (2) libpurple/protocols/msnp9/slplink.c in Pidgin (formerly Gaim) before 2.5.6 on 32-bit platforms allow remote attackers to execute arbitrary code via a malformed SLP message with a crafted offset value, leading to buffer overflows. NOTE: this issue exists because of an incomplete fix for CVE-2008-2927.

Remediation

No solution or workaround provided in the CVE record

Tracking

Sign in to view the affected projects.

Advisories

Source ID Title
Debian DSA Debian DSA DSA-1805-1 New pidgin packages fix several vulnerabilities
Debian DSA Debian DSA DSA-1870-1 New pidgin packages fix arbitrary code execution
Ubuntu USN Ubuntu USN USN-781-1 Pidgin vulnerabilities
Ubuntu USN Ubuntu USN USN-781-2 Gaim vulnerabilities
Ubuntu USN Ubuntu USN USN-886-1 Pidgin vulnerabilities
History

No history.

Weaknesses

Sources

Status
PUBLISHED
Assigner
redhat
Published
Updated
Aug 7, 2024, 5:13 AM
Reserved
Apr 23, 2009, 12:00 AM
Status
Modified
Published
May 26, 2009, 3:30 PM
Modified
Jun 16, 2026, 11:07 PM
Severity
Important
Public date
May 2, 2009, 12:00 AM