Microsoft Internet Explorer / MSN - ICC Profiles Crash (PoC)

/-----------------------------edwardgagnon--------------/ Can crash msn and execute commands Windows has a buffer overflow vulnerability in the processing of embedded ICC Profiles inside images jpeg, tiff, etc... To test - create a jpeg in adobe photoshop and save it with the ICC checkbox enabled...

FreeBSD : gaim -- MSN Remote DoS vulnerability (b6612eee-df5f-11d9-b875-0001020eed82)

The GAIM team reports : Remote attackers can cause a denial of service crash via a malformed MSN message that leads to a memory allocation of a large size, possibly due to an integer signedness error. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in...

FreeBSD : gaim -- MSN remote DoS vulnerability (ad5e70bb-c429-11d9-ac59-02061b08fc24)

The GAIM team reports : Potential remote denial of service bug resulting from not checking a pointer for non-NULL before passing it to strncmp, which results in a crash. This can be triggered by a remote client sending an SLP message with an empty body. %NASLMINLEVEL 70300 C Tenable Network...

Slackware 10.0 / 9.0 / 9.1 / current : gaim (SSA:2004-296-01)

New gaim packages are available for Slackware 9.0, 9.1, 10.0 and -current to fix a buffer overflow in the MSN protocol. Sites that use GAIM should upgrade to the new version. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted...

FreeBSD : gaim -- MSN denial-of-service vulnerabilities (f2d6a5e1-26b9-11d9-9289-000c41e2cdad)

The Gaim team discovered denial-of-service vulnerabilities in the MSN protocol handler : After accepting a file transfer request, Gaim will attempt to allocate a buffer of a size equal to the entire filesize, this allocation attempt will cause Gaim to crash if the size exceeds the amount of...

EUVD-2005-2226

Microsoft MSN Messenger allows remote attackers to cause a denial of service via a plaintext message containing the ".pif" string, which is interpreted as a malicious file extension and causes users to be kicked from a group conversation. NOTE: it has been reported that Gaim is also affected, so...

CVE-2005-2225

The CVE-2005-2225 entries describe a DoS condition in Microsoft MSN Messenger where remote attackers can cause users to be kicked from group conversations by sending a plaintext message containing the string ".pif". Gaim is also reported affected, suggesting the issue could be in the protocol or ...

CVE-2005-2225

Microsoft MSN Messenger allows remote attackers to cause a denial of service via a plaintext message containing the ".pif" string, which is interpreted as a malicious file extension and causes users to be kicked from a group conversation. NOTE: it has been reported that Gaim is also affected, so...

CVE-2005-2225

Microsoft MSN Messenger allows remote attackers to cause a denial of service via a plaintext message containing the ".pif" string, which is interpreted as a malicious file extension and causes users to be kicked from a group conversation. NOTE: it has been reported that Gaim is also affected, so...

Debian DSA-734-1 : gaim - denial of service

Two denial of service problems have been discovered in Gaim, a multi-protocol instant messaging client. The Common Vulnerabilities and Exposures project identifies the following problems : - CAN-2005-1269 A malformed Yahoo filename can result in a crash of the application. - CAN-2005-1934 A...

ZH2005-14SA.txt

ZH2005-14SA Phishing problems on MSN Date: July 1th 2005 Author:Giovanni Delvecchio email: [email protected] Overview ======= Multiple phishing problems exist on support.msn.com, permitting to a possible attacker to conduct phishing attack against a user. Details ===== 1Input passed to the "r...

CVE-2002-1831

MSN Messenger Service 1.0–4.6 is affected by a remote DoS vulnerability: an invite request containing hex-encoded spaces (%20) in the Invitation-Cookie field can crash the service. The available documents do not provide a root-cause analysis, affected versions beyond 1.0–4.6, exploit specifics, o...

CVE-2002-1831

Microsoft MSN Messenger Service 1.0 through 4.6 allows remote attackers to cause a denial of service crash via an invite request that contains hex-encoded spaces %20 in the Invitation-Cookie field...

CVE-2002-1698

The CVE-2002-1698 entry concerns Microsoft MSN Messenger Service versions 1.0 through 4.6. A buffer overflow vulnerability exists in the message header’s FN (font) field, allowing a remote attacker to trigger a denial of service (crash). The issue is caused by improper handling of a long font arg...

CVE-2002-1698

Buffer overflow in Microsoft MSN Messenger Service 1.0 through 4.6 allows remote attackers to cause a denial of service crash via a long FN font argument in the message header...

RHEL 3 / 4 : gaim (RHSA-2005:518)

An updated gaim package that fixes two denial of service issues is now available. This update has been rated as having moderate security impact by the Red Hat Security Response Team. The Gaim application is a multi-protocol instant messaging client. Jacopo Ottaviani discovered a bug in the way Ga...

gaim security update

CentOS Errata and Security Advisory CESA-2005:518 Merged security bulletin from advisories: https://lists.centos.org/pipermail/centos-announce/2005-June/074034.html https://lists.centos.org/pipermail/centos-announce/2005-June/074035.html...

Mandrake Linux Security Advisory : gaim (MDKSA-2005:099)

More vulnerabilities have been discovered in the gaim IM client. The first is a remote crash with the Yahoo! protocol CVE-2005-1269 and the second is a remote DoS in the MSN protocol CVE-2005-1934. These problems have been corrected in gaim 1.3.1 which is provided with this update. %NASLMINLEVEL...

USN-140-1: Gaim vulnerability

A remote Denial of Service vulnerability was discovered in Gaim. A remote attacker could crash the Gaim client of an MSN user by sending a specially crafted MSN package which states an invalid body length in the header...

gaim

New gaim packages are available for Slackware 9.0, 9.1, 10.0, 10.1, and -current to fix some minor security issues. Sites that use GAIM should upgrade to the new version. Here are the details from the Slackware 10.1 ChangeLog: patches/packages/gaim-1.3.1-i486-1.tgz: Upgraded to gaim-1.3.1 and...