2337 matches found
CVE-2011-3184
The msnhttpconnparsedata function in httpconn.c in the MSN protocol plugin in libpurple in Pidgin before 2.10.0 does not properly handle HTTP 100 responses, which allows remote attackers to cause a denial of service incorrect memory access and application crash via vectors involving a crafted...
CVE-2011-2943
The ircmsgwho function in msgs.c in the IRC protocol plugin in libpurple 2.8.0 through 2.9.0 in Pidgin before 2.10.0 does not properly validate characters in nicknames, which allows user-assisted remote attackers to cause a denial of service NULL pointer dereference and application crash via a...
Code injection
The msnhttpconnparsedata function in httpconn.c in the MSN protocol plugin in libpurple in Pidgin before 2.10.0 does not properly handle HTTP 100 responses, which allows remote attackers to cause a denial of service incorrect memory access and application crash via vectors involving a crafted...
Code injection
gtkutils.c in Pidgin before 2.10.0 on Windows allows user-assisted remote attackers to execute arbitrary programs via a file: URL in a message...
CVE-2011-2943
The ircmsgwho function in msgs.c in the IRC protocol plugin in libpurple 2.8.0 through 2.9.0 in Pidgin before 2.10.0 does not properly validate characters in nicknames, which allows user-assisted remote attackers to cause a denial of service NULL pointer dereference and application crash via a...
CVE-2011-2943
The ircmsgwho function in msgs.c in the IRC protocol plugin in libpurple 2.8.0 through 2.9.0 in Pidgin before 2.10.0 does not properly validate characters in nicknames, which allows user-assisted remote attackers to cause a denial of service NULL pointer dereference and application crash via a...
CVE-2011-3185
gtkutils.c in Pidgin before 2.10.0 on Windows allows user-assisted remote attackers to execute arbitrary programs via a file: URL in a message...
CVE-2011-2943
The ircmsgwho function in msgs.c in the IRC protocol plugin in libpurple 2.8.0 through 2.9.0 in Pidgin before 2.10.0 does not properly validate characters in nicknames, which allows user-assisted remote attackers to cause a denial of service NULL pointer dereference and application crash via a...
CVE-2011-3184
The msnhttpconnparsedata function in httpconn.c in the MSN protocol plugin in libpurple in Pidgin before 2.10.0 does not properly handle HTTP 100 responses, which allows remote attackers to cause a denial of service incorrect memory access and application crash via vectors involving a crafted...
CVE-2011-3184
CVE-2011-3184 affects Pidgin (libpurple) MSN protocol plugin prior to version 2.10.0. The msn_httpconn_parse_data function fails to handle HTTP 100 responses, enabling a remote attacker to trigger incorrect memory access and cause a denial of service (application crash). The Ubuntu advisories and...
CVE-2011-3185
CVE-2011-3185 affects Pidgin (gtkutils.c) on Windows prior to 2.10.0. A message containing a file: URL could trigger an explorer.exe command, allowing user-assisted remote code execution; this is attributed to an incomplete fix for CVE-2011-3185. Connected sources confirm the Windows GTK utils pa...
CVE-2011-2943
The ircmsgwho function in msgs.c in the IRC protocol plugin in libpurple 2.8.0 through 2.9.0 in Pidgin before 2.10.0 does not properly validate characters in nicknames, which allows user-assisted remote attackers to cause a denial of service NULL pointer dereference and application crash via a...
CVE-2011-3185
gtkutils.c in Pidgin before 2.10.0 on Windows allows user-assisted remote attackers to execute arbitrary programs via a file: URL in a message...
CVE-2011-2943
Pidgin (libpurple IRC protocol plugin) is affected by CVE-2011-2943. The irc_msg_who handler in msgs.c fails to validate characters in nicknames, allowing user-assisted remote attackers to trigger a denial of service (NULL pointer dereference and crash). Affected versions are libpurple 2.8.0–2.9....
CVE-2011-3185
gtkutils.c in Pidgin before 2.10.0 on Windows allows user-assisted remote attackers to execute arbitrary programs via a file: URL in a message...
CVE-2011-3184
The msnhttpconnparsedata function in httpconn.c in the MSN protocol plugin in libpurple in Pidgin before 2.10.0 does not properly handle HTTP 100 responses, which allows remote attackers to cause a denial of service incorrect memory access and application crash via vectors involving a crafted...
CVE-2011-3184
The msnhttpconnparsedata function in httpconn.c in the MSN protocol plugin in libpurple in Pidgin before 2.10.0 does not properly handle HTTP 100 responses, which allows remote attackers to cause a denial of service incorrect memory access and application crash via vectors involving a crafted...
Pidgin拒绝服务和安全绕过漏洞
Bugtraq ID: 49268 CVE ID：CVE-2011-2943 Pidgin是一款多协议即时通信软件。 Pidgin存在安全漏洞，允许恶意攻击者进行拒绝服务或任意代码执行攻击。 1当处理昵称中包含特殊字符的WHO应答时IRC协议插件存在错误，可被利用触发空指针引用。 2解析HTTP 100应答时MSN协议插件存在错误，可被利用使应用程序崩溃。 成功利用漏洞需要HTTP连接方法启用默认禁用并使用恶意服务器。 3Pidgin支持IM会话中使用URL处理器，windows平台下直接把URL提交给ShellExecute API，并以当前用户运行。当通过file://...
