CVE-2009-3084

Published: Sep 8, 2009Modified: Apr 23, 2026

5.0

Vector

AV:N/AC:L/Au:N/C:N/I:N/A:P

Exploitability: 10.0 / Impact: 2.9

Source: NVD

Description

The msn_slp_process_msg function in libpurple/protocols/msn/slpcall.c in the MSN protocol plugin in libpurple 2.6.0 and 2.6.1, as used in Pidgin before 2.6.2, allows remote attackers to cause a denial of service (application crash) via a handwritten (aka Ink) message, related to an uninitialized variable and the incorrect "UTF16-LE" charset name.

Affected (38)

Products: Pidgin: Pidgin, Libpurple

Pidgin

2 products

Pidgin

Libpurple

Configuration A

38 vulnerable

Vulnerable Software	Affected Versions
Pidgin Pidgin	version ≤ 2.6.1
Pidgin Pidgin	Version 2.0.0
Pidgin Pidgin	Version 2.0.1
Pidgin Pidgin	Version 2.0.2
Pidgin Pidgin	Version 2.0.2
Pidgin Pidgin	Version 2.1.0
Pidgin Pidgin	Version 2.1.1
Pidgin Pidgin	Version 2.2.0
Pidgin Pidgin	Version 2.2.1
Pidgin Pidgin	Version 2.2.2
Pidgin Pidgin	Version 2.3.0
Pidgin Pidgin	Version 2.3.1
Pidgin Pidgin	Version 2.4.0
Pidgin Pidgin	Version 2.4.0 32_bit
Pidgin Pidgin	Version 2.4.1
Pidgin Pidgin	Version 2.4.1 32_bit
Pidgin Pidgin	Version 2.4.2
Pidgin Pidgin	Version 2.4.2 32_bit
Pidgin Pidgin	Version 2.4.3
Pidgin Pidgin	Version 2.4.3 32_bit
Pidgin Pidgin	Version 2.5.0
Pidgin Pidgin	Version 2.5.0 32_bit
Pidgin Pidgin	Version 2.5.1
Pidgin Pidgin	Version 2.5.2
Pidgin Pidgin	Version 2.5.2 32_bit
Pidgin Pidgin	Version 2.5.3
Pidgin Pidgin	Version 2.5.3 32_bit
Pidgin Pidgin	Version 2.5.4
Pidgin Pidgin	Version 2.5.4 32_bit
Pidgin Pidgin	Version 2.5.5
Pidgin Pidgin	Version 2.5.5 32_bit
Pidgin Pidgin	Version 2.5.6
Pidgin Pidgin	Version 2.5.7
Pidgin Pidgin	Version 2.5.8
Pidgin Pidgin	Version 2.5.9
Pidgin Pidgin	Version 2.6.0
Pidgin Libpurple	Version 2.6.0
Pidgin Libpurple	Version 2.6.1