CVE-2009-2694

Published: Aug 21, 2009Modified: Apr 23, 2026

10.0

Vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Exploitability: 10.0 / Impact: 10.0

Source: NVD

Description

The msn_slplink_process_msg function in libpurple/protocols/msn/slplink.c in libpurple, as used in Pidgin (formerly Gaim) before 2.5.9 and Adium 1.3.5 and earlier, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) by sending multiple crafted SLP (aka MSNSLP) messages to trigger an overwrite of an arbitrary memory location. NOTE: this issue reportedly exists because of an incomplete fix for CVE-2009-1376.

Affected (29)

Products: Adium: Adium · Pidgin: Pidgin

1 product

1 product

Configuration A

29 vulnerable

Vulnerable Software	Affected Versions
Adium Adium	Up to 1.3.5
Adium Adium	Version 1.2.7
Adium Adium	Version 1.3.1
Adium Adium	Version 1.3.2
Adium Adium	Version 1.3.3
Adium Adium	Version 1.3.4
Adium Adium	Version 1.3
Pidgin Pidgin	Up to 2.5.8
Pidgin Pidgin	Version 2.0.0
Pidgin Pidgin	Version 2.0.1
Pidgin Pidgin	Version 2.0.2
Pidgin Pidgin	Version 2.1.0
Pidgin Pidgin	Version 2.1.1
Pidgin Pidgin	Version 2.2.0
Pidgin Pidgin	Version 2.2.1
Pidgin Pidgin	Version 2.2.2
Pidgin Pidgin	Version 2.3.0
Pidgin Pidgin	Version 2.3.1
Pidgin Pidgin	Version 2.4.0
Pidgin Pidgin	Version 2.4.1
Pidgin Pidgin	Version 2.4.2
Pidgin Pidgin	Version 2.4.3
Pidgin Pidgin	Version 2.5.0
Pidgin Pidgin	Version 2.5.1
Pidgin Pidgin	Version 2.5.2
Pidgin Pidgin	Version 2.5.3
Pidgin Pidgin	Version 2.5.4
Pidgin Pidgin	Version 2.5.6
Pidgin Pidgin	Version 2.5.7

Related CWEs

References (38)

http://developer.pidgin.im/viewmtn/revision/info/6f7343166c673bf0496ecb1afec9b633c1d54a0e

Source: cve@mitre.org

Patch

http://developer.pidgin.im/wiki/ChangeLog

Source: cve@mitre.org

http://secunia.com/advisories/36384

Source: cve@mitre.org

Vendor Advisory

http://secunia.com/advisories/36392

Source: cve@mitre.org

Vendor Advisory

http://secunia.com/advisories/36401

Source: cve@mitre.org

Vendor Advisory

http://secunia.com/advisories/36402

Source: cve@mitre.org

http://secunia.com/advisories/36708

Source: cve@mitre.org

http://secunia.com/advisories/37071

Source: cve@mitre.org

http://sunsolve.sun.com/search/document.do?assetkey=1-66-266908-1

Source: cve@mitre.org

http://www.coresecurity.com/content/libpurple-arbitrary-write

Source: cve@mitre.org

Exploit

http://www.debian.org/security/2009/dsa-1870

Source: cve@mitre.org

Patch

http://www.exploit-db.com/exploits/9615

Source: cve@mitre.org

http://www.pidgin.im/news/security/?id=34

Source: cve@mitre.org

Vendor Advisory

http://www.vupen.com/english/advisories/2009/2303

Source: cve@mitre.org

Vendor Advisory

http://www.vupen.com/english/advisories/2009/2663

Source: cve@mitre.org

https://bugzilla.redhat.com/show_bug.cgi?id=514957

Source: cve@mitre.org

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10319

Source: cve@mitre.org

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6320

Source: cve@mitre.org

https://rhn.redhat.com/errata/RHSA-2009-1218.html

Source: cve@mitre.org

Vendor Advisory

http://developer.pidgin.im/viewmtn/revision/info/6f7343166c673bf0496ecb1afec9b633c1d54a0e

Source: af854a3a-2127-422b-91ae-364da2661108

Patch

http://developer.pidgin.im/wiki/ChangeLog

Source: af854a3a-2127-422b-91ae-364da2661108

http://secunia.com/advisories/36384

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

http://secunia.com/advisories/36392

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

http://secunia.com/advisories/36401

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

http://secunia.com/advisories/36402

Source: af854a3a-2127-422b-91ae-364da2661108

http://secunia.com/advisories/36708

Source: af854a3a-2127-422b-91ae-364da2661108

http://secunia.com/advisories/37071

Source: af854a3a-2127-422b-91ae-364da2661108

http://sunsolve.sun.com/search/document.do?assetkey=1-66-266908-1

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.coresecurity.com/content/libpurple-arbitrary-write

Source: af854a3a-2127-422b-91ae-364da2661108

Exploit

http://www.debian.org/security/2009/dsa-1870

Source: af854a3a-2127-422b-91ae-364da2661108

Patch

http://www.exploit-db.com/exploits/9615

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.pidgin.im/news/security/?id=34

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

http://www.vupen.com/english/advisories/2009/2303

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

http://www.vupen.com/english/advisories/2009/2663

Source: af854a3a-2127-422b-91ae-364da2661108

https://bugzilla.redhat.com/show_bug.cgi?id=514957

Source: af854a3a-2127-422b-91ae-364da2661108

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10319

Source: af854a3a-2127-422b-91ae-364da2661108

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6320

Source: af854a3a-2127-422b-91ae-364da2661108

https://rhn.redhat.com/errata/RHSA-2009-1218.html

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

Timeline

No history available yet.