CVE-2010-4528

Published: Jan 7, 2011Modified: Apr 29, 2026

4.0

Vector

AV:N/AC:L/Au:S/C:N/I:N/A:P

Exploitability: 8.0 / Impact: 2.9

Source: NVD

Description

directconn.c in the MSN protocol plugin in libpurple 2.7.6 through 2.7.8 in Pidgin before 2.7.9 allows remote authenticated users to cause a denial of service (NULL pointer dereference and application crash) via a short p2pv2 packet in a DirectConnect (aka direct connection) session.

Affected (42)

Products: Pidgin: Libpurple, Pidgin

2 products

Configuration A

42 vulnerable

Vulnerable Software	Affected Versions
Pidgin Libpurple	Version 2.7.6
Pidgin Libpurple	Version 2.7.7
Pidgin Libpurple	Version 2.7.8
Pidgin Pidgin	Up to 2.7.8
Pidgin Pidgin	Version 2.0.0
Pidgin Pidgin	Version 2.0.1
Pidgin Pidgin	Version 2.0.2
Pidgin Pidgin	Version 2.1.0
Pidgin Pidgin	Version 2.1.1
Pidgin Pidgin	Version 2.2.0
Pidgin Pidgin	Version 2.2.1
Pidgin Pidgin	Version 2.2.2
Pidgin Pidgin	Version 2.3.0
Pidgin Pidgin	Version 2.3.1
Pidgin Pidgin	Version 2.4.0
Pidgin Pidgin	Version 2.4.1
Pidgin Pidgin	Version 2.4.2
Pidgin Pidgin	Version 2.4.3
Pidgin Pidgin	Version 2.5.0
Pidgin Pidgin	Version 2.5.1
Pidgin Pidgin	Version 2.5.2
Pidgin Pidgin	Version 2.5.3
Pidgin Pidgin	Version 2.5.4
Pidgin Pidgin	Version 2.5.5
Pidgin Pidgin	Version 2.5.6
Pidgin Pidgin	Version 2.5.7
Pidgin Pidgin	Version 2.5.8
Pidgin Pidgin	Version 2.5.9
Pidgin Pidgin	Version 2.6.0
Pidgin Pidgin	Version 2.6.1
Pidgin Pidgin	Version 2.6.2
Pidgin Pidgin	Version 2.6.4
Pidgin Pidgin	Version 2.6.5
Pidgin Pidgin	Version 2.6.6
Pidgin Pidgin	Version 2.7.0
Pidgin Pidgin	Version 2.7.1
Pidgin Pidgin	Version 2.7.2
Pidgin Pidgin	Version 2.7.3
Pidgin Pidgin	Version 2.7.4
Pidgin Pidgin	Version 2.7.5
Pidgin Pidgin	Version 2.7.6
Pidgin Pidgin	Version 2.7.7

Related CWEs

Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

References (38)

http://developer.pidgin.im/viewmtn/revision/diff/e76f4ad4ef2f10588195a0eedc7a08f82062f79c/with/aaa07bde3c51d3684391ae6ed86b6dbaeab5d031/libpurple/protocols/msn/directconn.c

Source: secalert@redhat.com

Patch

http://developer.pidgin.im/viewmtn/revision/info/aaa07bde3c51d3684391ae6ed86b6dbaeab5d031

Source: secalert@redhat.com

Patch

http://lists.fedoraproject.org/pipermail/package-announce/2011-January/052862.html

Source: secalert@redhat.com

http://lists.fedoraproject.org/pipermail/package-announce/2011-January/052905.html

Source: secalert@redhat.com

http://lists.opensuse.org/opensuse-security-announce/2011-01/msg00003.html

Source: secalert@redhat.com

http://pidgin.im/pipermail/support/2010-December/009251.html

Source: secalert@redhat.com

Patch

http://secunia.com/advisories/42732

Source: secalert@redhat.com

Vendor Advisory

http://secunia.com/advisories/42824

Source: secalert@redhat.com

Vendor Advisory

http://secunia.com/advisories/42877

Source: secalert@redhat.com

http://www.mandriva.com/security/advisories?name=MDVSA-2010:259

Source: secalert@redhat.com

http://www.openwall.com/lists/oss-security/2010/12/27/1

Source: secalert@redhat.com

Patch

http://www.openwall.com/lists/oss-security/2010/12/31/5

Source: secalert@redhat.com

Patch

http://www.pidgin.im/news/security/?id=49

Source: secalert@redhat.com

PatchVendor Advisory

http://www.securityfocus.com/bid/45581

Source: secalert@redhat.com

http://www.vupen.com/english/advisories/2011/0028

Source: secalert@redhat.com

Vendor Advisory

http://www.vupen.com/english/advisories/2011/0054

Source: secalert@redhat.com

http://www.vupen.com/english/advisories/2011/0076

Source: secalert@redhat.com

https://bugzilla.redhat.com/show_bug.cgi?id=665421

Source: secalert@redhat.com

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A18461

Source: secalert@redhat.com

http://developer.pidgin.im/viewmtn/revision/diff/e76f4ad4ef2f10588195a0eedc7a08f82062f79c/with/aaa07bde3c51d3684391ae6ed86b6dbaeab5d031/libpurple/protocols/msn/directconn.c

Source: af854a3a-2127-422b-91ae-364da2661108

Patch

http://developer.pidgin.im/viewmtn/revision/info/aaa07bde3c51d3684391ae6ed86b6dbaeab5d031

Source: af854a3a-2127-422b-91ae-364da2661108

Patch

http://lists.fedoraproject.org/pipermail/package-announce/2011-January/052862.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://lists.fedoraproject.org/pipermail/package-announce/2011-January/052905.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://lists.opensuse.org/opensuse-security-announce/2011-01/msg00003.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://pidgin.im/pipermail/support/2010-December/009251.html

Source: af854a3a-2127-422b-91ae-364da2661108

Patch

http://secunia.com/advisories/42732

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

http://secunia.com/advisories/42824

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

http://secunia.com/advisories/42877

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.mandriva.com/security/advisories?name=MDVSA-2010:259

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.openwall.com/lists/oss-security/2010/12/27/1

Source: af854a3a-2127-422b-91ae-364da2661108

Patch

http://www.openwall.com/lists/oss-security/2010/12/31/5

Source: af854a3a-2127-422b-91ae-364da2661108

Patch

http://www.pidgin.im/news/security/?id=49

Source: af854a3a-2127-422b-91ae-364da2661108

PatchVendor Advisory

http://www.securityfocus.com/bid/45581

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.vupen.com/english/advisories/2011/0028

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

http://www.vupen.com/english/advisories/2011/0054

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.vupen.com/english/advisories/2011/0076

Source: af854a3a-2127-422b-91ae-364da2661108

https://bugzilla.redhat.com/show_bug.cgi?id=665421

Source: af854a3a-2127-422b-91ae-364da2661108

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A18461

Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.