CVE-2008-2957

The UPnP functionality in Pidgin 2.0.0, and possibly other versions, allows remote attackers to trigger the download of arbitrary files and cause a denial of service memory or disk consumption via a UDP packet that specifies an arbitrary URL...

CVE-2008-2955

Pidgin 2.4.1 allows remote attackers to cause a denial of service crash via a long filename that contains certain characters, as demonstrated using an MSN message that triggers the crash in the msnslplinkprocessmsg function...

CVE-2008-2955

Pidgin 2.4.1 vulnerability CVE-2008-2955 allows remote denial of service by sending a MSN message with a long filename containing certain characters, triggering a crash in msn_slplink_process_msg. Connected advisories corroborate a crash condition in Pidgin’s MSN protocol handler and note related...

CVE-2008-2957

The UPnP functionality in Pidgin 2.0.0, and possibly other versions, allows remote attackers to trigger the download of arbitrary files and cause a denial of service memory or disk consumption via a UDP packet that specifies an arbitrary URL...

CVE-2008-2956

Memory leak in Pidgin 2.0.0, and possibly other versions, allows remote attackers to cause a denial of service memory consumption via malformed XML documents. NOTE: this issue has been disputed by the upstream vendor, who states: "I was never able to identify a scenario under which a problem...

PT-2008-4391 · Pidgin +1 · Pidgin +1

Name of the Vulnerable Software and Affected Versions: Pidgin versions 2.0.0 and possibly other versions Description: A memory leak in Pidgin allows remote attackers to cause a denial of service via malformed XML documents. The issue has been disputed by the upstream vendor due to a lack of...

Pidgin UPnP和Jabber协议处理拒绝服务漏洞

BUGTRAQ ID: 29985 Pidgin是支持多种协议的即时通讯客户端。 Pidgin的XML解析器在解析畸形XML文件时存在内存泄露漏洞。不可信任的XML文档是通过UPnP和Jabber协议交换的，而UPnP实现没有限制HTTP下载的大小。由于可通过包含有任意URL的UDP报文触发下载，因此攻击者可以导致Pidgin从网站下载任意大小的文档，耗费带宽资源。 仅在有限的环境中才会出现上述两个漏洞： XML内存泄露漏洞要求用户连接到恶意的Jabber服务器，或连接到转发过程中无法检查畸形XML的Jabber服务器；仅在Pidgin启动时很小的时间窗口才可以利用UPnP漏洞。...

CVE-2008-2956: Undefined Security Weakness

Memory leak in Pidgin 2.0.0, and possibly other versions, allows remote attackers to cause a denial of service memory consumption via malformed XML documents. NOTE: this issue has been disputed by the upstream vendor, who states: "I was never able to identify a scenario under which a problem...

CVE-2008-2956

CVE-2008-2956 concerns Pidgin 2.0.0 (and possibly other versions) with a memory leak that can be triggered by malformed XML documents, leading to denial of service through memory consumption. The vulnerability description notes that upstream vendor disputes the issue, stating they have not identi...

CVE-2008-2957: Improper Input Validation

The UPnP functionality in Pidgin 2.0.0, and possibly other versions, allows remote attackers to trigger the download of arbitrary files and cause a denial of service memory or disk consumption via a UDP packet that specifies an arbitrary URL...

CVE-2008-2955: Improper Input Validation

Pidgin 2.4.1 allows remote attackers to cause a denial of service crash via a long filename that contains certain characters, as demonstrated using an MSN message that triggers the crash in the msnslplinkprocessmsg function...

CVE-2008-2956

Memory leak in Pidgin 2.0.0, and possibly other versions, allows remote attackers to cause a denial of service memory consumption via malformed XML documents. NOTE: this issue has been disputed by the upstream vendor, who states: "I was never able to identify a scenario under which a problem...

Pidgin MSN协议文件名处理拒绝服务漏洞

BUGTRAQ ID: 29956 Pidgin是支持多种协议的即时通讯客户端。 Pidgin的libpurple/protocols/msnp9/slplink.c文件中的msnslplinkprocessmsg函数在处理MSN P2P文件传输请求时存在使用后释放漏洞，如果用户受骗接收了带有特制文件名的文件的话，就会引用之前已经释放的内存，导致拒绝服务。 Pidgin 2.4.1 Pidgin ------ 目前厂商还没有提供补丁或者升级程序，我们建议使用此软件的用户随时关注厂商的主页以获取最新版本： http://pidgin.im/pidgin/home/ 创建包含有以下字符的文件...

Pidgin 2.4.1 Vulnerability

Application: Pidgin 2.4.1 OS: Linux - Ubuntu 8.04 ------------------------------------------------------ 1 - Description 2 - Vulnerability 3 - POC/EXPLOIT ------------------------------------------------------ Description Pidgin is an instant messaging program with which you can use a number of...

Ubuntu 7.10 : pidgin vulnerability (USN-548-1)

It was discovered that Pidgin did not correctly handle certain logging events. A remote attacker could send specially crafted messages and cause the application to crash, leading to a denial of service. Note that Tenable Network Security has extracted the preceding description block directly from...

USN-548-1: Pidgin vulnerability

It was discovered that Pidgin did not correctly handle certain logging events. A remote attacker could send specially crafted messages and cause the application to crash, leading to a denial of service...

openSUSE 10 Security Update : libpurple (libpurple-4671)

This update fixes a crash in pidgin when specifying invalid HMTL. CVE-2007-4999 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from openSUSE Security Update libpurple-4671. The text description of this plugin is C SUSE LL...

Fedora 7 : pidgin-2.2.1-1.fc7 (2007-2368)

Minor DOS fix and a great many other bug fixes in upstream's 2.2.1 release. http://developer.pidgin.im/wiki/ChangeLog Upstream changelog. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to...

Fedora 7 : pidgin-2.2.2-1.fc7 (2007-2714)

2.2.2 and CVE-2007-4999 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. %NASLMINLEVEL 70300 C Tenable...

[SECURITY] Fedora 7 Update: pidgin-2.2.2-1.fc7

Pidgin allows you to talk to anyone using a variety of messaging protocols including AIM, MSN, Yahoo!, Jabber, Bonjour, Gadu-Gadu, ICQ, IRC, Novell Groupwise, QQ, Lotus Sametime, SILC, Simple and Zephyr. These protocols are implemented using a modular, easy to use design. To use a protocol, just...