CVE-2009-1376

2009-05-2615:30:00

CWE-189

[email protected]

web.nvd.nist.gov

cve-2009-1376

integer overflows

msn protocol

pidgin

buffer overflows

remote code execution

7.9 High

AI Score

Confidence

Low

9.3 High

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:M/Au:N/C:C/I:C/A:C

0.203 Low

EPSS

Percentile

96.3%

JSON

Multiple integer overflows in the msn_slplink_process_msg functions in the MSN protocol handler in (1) libpurple/protocols/msn/slplink.c and (2) libpurple/protocols/msnp9/slplink.c in Pidgin (formerly Gaim) before 2.5.6 on 32-bit platforms allow remote attackers to execute arbitrary code via a malformed SLP message with a crafted offset value, leading to buffer overflows. NOTE: this issue exists because of an incomplete fix for CVE-2008-2927.

CPENameOperatorVersion
pidgin:pidginpidgineq2.5.2
pidgin:pidginpidgineq2.5.3
pidgin:pidginpidgineq2.5.0
pidgin:pidginpidgineq2.4.2
pidgin:pidginpidginle2.5.5
pidgin:pidginpidgineq2.4.0
pidgin:pidginpidgineq2.4.3
pidgin:pidginpidgineq2.5.4
pidgin:pidginpidgineq2.4.1

CPE	Name	Operator	Version
pidgin:pidgin	pidgin	eq	2.5.2
pidgin:pidgin	pidgin	eq	2.5.3
pidgin:pidgin	pidgin	eq	2.5.0
pidgin:pidgin	pidgin	eq	2.4.2
pidgin:pidgin	pidgin	le	2.5.5
pidgin:pidgin	pidgin	eq	2.4.0
pidgin:pidgin	pidgin	eq	2.4.3
pidgin:pidgin	pidgin	eq	2.5.4
pidgin:pidgin	pidgin	eq	2.4.1