CVE-2011-2943

Pidgin (libpurple IRC protocol plugin) is affected by CVE-2011-2943. The irc_msg_who handler in msgs.c fails to validate characters in nicknames, allowing user-assisted remote attackers to trigger a denial of service (NULL pointer dereference and crash). Affected versions are libpurple 2.8.0–2.9....

CVE-2011-2943

The ircmsgwho function in msgs.c in the IRC protocol plugin in libpurple 2.8.0 through 2.9.0 in Pidgin before 2.10.0 does not properly validate characters in nicknames, which allows user-assisted remote attackers to cause a denial of service NULL pointer dereference and application crash via a...

CVE-2011-3185

CVE-2011-3185 affects Pidgin (gtkutils.c) on Windows prior to 2.10.0. A message containing a file: URL could trigger an explorer.exe command, allowing user-assisted remote code execution; this is attributed to an incomplete fix for CVE-2011-3185. Connected sources confirm the Windows GTK utils pa...

CVE-2011-3184

CVE-2011-3184 affects Pidgin (libpurple) MSN protocol plugin prior to version 2.10.0. The msn_httpconn_parse_data function fails to handle HTTP 100 responses, enabling a remote attacker to trigger incorrect memory access and cause a denial of service (application crash). The Ubuntu advisories and...

CVE-2011-3185

gtkutils.c in Pidgin before 2.10.0 on Windows allows user-assisted remote attackers to execute arbitrary programs via a file: URL in a message...

CVE-2011-2943

The ircmsgwho function in msgs.c in the IRC protocol plugin in libpurple 2.8.0 through 2.9.0 in Pidgin before 2.10.0 does not properly validate characters in nicknames, which allows user-assisted remote attackers to cause a denial of service NULL pointer dereference and application crash via a...

CVE-2011-3184

The msnhttpconnparsedata function in httpconn.c in the MSN protocol plugin in libpurple in Pidgin before 2.10.0 does not properly handle HTTP 100 responses, which allows remote attackers to cause a denial of service incorrect memory access and application crash via vectors involving a crafted...

CVE-2011-3185: Improper Input Validation

gtkutils.c in Pidgin before 2.10.0 on Windows allows user-assisted remote attackers to execute arbitrary programs via a file: URL in a message...

PT-2011-4296

Name of the Vulnerable Software and Affected Versions Pidgin versions prior to 2.10.0 Description The issue is related to the msn httpconn parse data function in the MSN protocol plugin, which does not properly handle HTTP 100 responses. This allows remote attackers to cause a denial of service,...

CVE-2011-3184

The msnhttpconnparsedata function in httpconn.c in the MSN protocol plugin in libpurple in Pidgin before 2.10.0 does not properly handle HTTP 100 responses, which allows remote attackers to cause a denial of service incorrect memory access and application crash via vectors involving a crafted...

CVE-2011-2943: Undefined Security Weakness

The ircmsgwho function in msgs.c in the IRC protocol plugin in libpurple 2.8.0 through 2.9.0 in Pidgin before 2.10.0 does not properly validate characters in nicknames, which allows user-assisted remote attackers to cause a denial of service NULL pointer dereference and application crash via a...

PT-2011-4194

Name of the Vulnerable Software and Affected Versions Pidgin versions 2.8.0 through 2.9.0 Description The issue arises from the irc msg who function in the IRC protocol plugin, which fails to properly validate characters in nicknames. This allows remote attackers to cause a denial of service,...

PT-2011-4297

Name of the Vulnerable Software and Affected Versions Pidgin versions prior to 2.10.0 Description The issue allows user-assisted remote attackers to execute arbitrary programs via a file: URL in a message. This is due to a problem in the gtkutils.c file on Windows. Recommendations For versions...

Pidgin拒绝服务和安全绕过漏洞

Bugtraq ID: 49268 CVE ID：CVE-2011-2943 Pidgin是一款多协议即时通信软件。 Pidgin存在安全漏洞，允许恶意攻击者进行拒绝服务或任意代码执行攻击。 1当处理昵称中包含特殊字符的WHO应答时IRC协议插件存在错误，可被利用触发空指针引用。 2解析HTTP 100应答时MSN协议插件存在错误，可被利用使应用程序崩溃。 成功利用漏洞需要HTTP连接方法启用默认禁用并使用恶意服务器。 3Pidgin支持IM会话中使用URL处理器，windows平台下直接把URL提交给ShellExecute API，并以当前用户运行。当通过file://...

Security fix for the ALT Linux 5 package pidgin version 2.9.0-alt1.M50P.1

Aug. 23, 2011 Gleb Fotengauer-Malinovskiy 2.9.0-alt1.M50P.1 - Backport to p5 branch CVE-2011-2485...

Security fix for the ALT Linux 5 package pidgin-mini version 2.9.0-alt2.M50P.1

Aug. 23, 2011 Gleb Fotengauer-Malinovskiy 2.9.0-alt2.M50P.1 - backport to p5 branch CVE-2011-2485...

Pidgin < 2.10.0 Multiple Vulnerabilities

The version of Pidgin installed on the remote host is earlier than 2.10.0. As such, it is potentially affected by the following issues : - A code execution vulnerability caused by clicking on a file:// URI received in an IM that Pidgin will attempt to execute. This can result in the execution of...

CentOS Update for pidgin CESA-2009:1218 centos3 i386

Check for the Version of pidgin OpenVAS Vulnerability Test CentOS Update for pidgin CESA-2009:1218 centos3 i386 Authors: System Generated Check Copyright: Copyright c 2011 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it and/or modify it und...

CentOS Update for finch CESA-2009:1453 centos5 i386

Check for the Version of finch OpenVAS Vulnerability Test CentOS Update for finch CESA-2009:1453 centos5 i386 Authors: System Generated Check Copyright: Copyright c 2011 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it and/or modify it under...

CentOS Update for pidgin CESA-2009:1535 centos3 i386

Check for the Version of pidgin OpenVAS Vulnerability Test CentOS Update for pidgin CESA-2009:1535 centos3 i386 Authors: System Generated Check Copyright: Copyright c 2011 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it and/or modify it und...