Pidgin MSN协议文件名处理拒绝服务漏洞

BUGTRAQ ID: 29956 Pidgin是支持多种协议的即时通讯客户端。 Pidgin的libpurple/protocols/msnp9/slplink.c文件中的msnslplinkprocessmsg函数在处理MSN P2P文件传输请求时存在使用后释放漏洞，如果用户受骗接收了带有特制文件名的文件的话，就会引用之前已经释放的内存，导致拒绝服务。 Pidgin 2.4.1 Pidgin ------ 目前厂商还没有提供补丁或者升级程序，我们建议使用此软件的用户随时关注厂商的主页以获取最新版本： http://pidgin.im/pidgin/home/ 创建包含有以下字符的文件...

Pidgin 2.4.1 Vulnerability

Application: Pidgin 2.4.1 OS: Linux - Ubuntu 8.04 ------------------------------------------------------ 1 - Description 2 - Vulnerability 3 - POC/EXPLOIT ------------------------------------------------------ Description Pidgin is an instant messaging program with which you can use a number of...

Ubuntu 7.10 : pidgin vulnerability (USN-548-1)

It was discovered that Pidgin did not correctly handle certain logging events. A remote attacker could send specially crafted messages and cause the application to crash, leading to a denial of service. Note that Tenable Network Security has extracted the preceding description block directly from...

USN-548-1: Pidgin vulnerability

It was discovered that Pidgin did not correctly handle certain logging events. A remote attacker could send specially crafted messages and cause the application to crash, leading to a denial of service...

openSUSE 10 Security Update : libpurple (libpurple-4671)

This update fixes a crash in pidgin when specifying invalid HMTL. CVE-2007-4999 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from openSUSE Security Update libpurple-4671. The text description of this plugin is C SUSE LL...

Fedora 7 : pidgin-2.2.1-1.fc7 (2007-2368)

Minor DOS fix and a great many other bug fixes in upstream's 2.2.1 release. http://developer.pidgin.im/wiki/ChangeLog Upstream changelog. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to...

Fedora 7 : pidgin-2.2.2-1.fc7 (2007-2714)

2.2.2 and CVE-2007-4999 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. %NASLMINLEVEL 70300 C Tenable...

[SECURITY] Fedora 7 Update: pidgin-2.2.2-1.fc7

Pidgin allows you to talk to anyone using a variety of messaging protocols including AIM, MSN, Yahoo!, Jabber, Bonjour, Gadu-Gadu, ICQ, IRC, Novell Groupwise, QQ, Lotus Sametime, SILC, Simple and Zephyr. These protocols are implemented using a modular, easy to use design. To use a protocol, just...

CVE-2007-4999

libpurple in Pidgin 2.1.0 through 2.2.1, when using HTML logging, allows remote attackers to cause a denial of service NULL dereference and application crash via a message that contains invalid HTML data, a different vector than CVE-2007-4996...

CVE-2007-4999

libpurple in Pidgin 2.1.0 through 2.2.1, when using HTML logging, allows remote attackers to cause a denial of service NULL dereference and application crash via a message that contains invalid HTML data, a different vector than CVE-2007-4996...

CVE-2007-4999

libpurple in Pidgin 2.1.0 through 2.2.1, when using HTML logging, allows remote attackers to cause a denial of service NULL dereference and application crash via a message that contains invalid HTML data, a different vector than CVE-2007-4996...

Design/Logic Flaw

libpurple in Pidgin 2.1.0 through 2.2.1, when using HTML logging, allows remote attackers to cause a denial of service NULL dereference and application crash via a message that contains invalid HTML data, a different vector than CVE-2007-4996...

DEBIAN-CVE-2007-4999

libpurple in Pidgin 2.1.0 through 2.2.1, when using HTML logging, allows remote attackers to cause a denial of service NULL dereference and application crash via a message that contains invalid HTML data, a different vector than CVE-2007-4996...

CVE-2007-4999

libpurple in Pidgin 2.1.0 through 2.2.1, when using HTML logging, allows remote attackers to cause a denial of service NULL dereference and application crash via a message that contains invalid HTML data, a different vector than CVE-2007-4996...

CVE-2007-4999

libpurple in Pidgin 2.1.0 through 2.2.1, when using HTML logging, allows remote attackers to cause a denial of service NULL dereference and application crash via a message that contains invalid HTML data, a different vector than CVE-2007-4996...

CVE-2007-4999

CVE-2007-4999 affects libpurple/Pidgin versions 2.1.0–2.2.1 with HTML logging enabled. The issue causes a NULL dereference and application crash when processing messages containing invalid HTML data, resulting in denial of service. Public references in OpenVAS/Ubuntu/Fedora/openSUSE advisories in...

DEBIAN-CVE-2007-5379

Rails before 1.2.4, as used for Ruby on Rails, allows remote attackers and ActiveResource servers to determine the existence of arbitrary files and read arbitrary XML files via the Hash.fromxml Hashfromxml method, which uses XmlSimple XML::Simple unsafely, as demonstrated by reading passwords fro...

Design/Logic Flaw

Rails before 1.2.4, as used for Ruby on Rails, allows remote attackers and ActiveResource servers to determine the existence of arbitrary files and read arbitrary XML files via the Hash.fromxml Hashfromxml method, which uses XmlSimple XML::Simple unsafely, as demonstrated by reading passwords fro...

[SECURITY] Fedora 7 Update: pidgin-2.2.1-1.fc7

Pidgin allows you to talk to anyone using a variety of messaging protocols including AIM, MSN, Yahoo!, Jabber, Bonjour, Gadu-Gadu, ICQ, IRC, Novell Groupwise, QQ, Lotus Sametime, SILC, Simple and Zephyr. These protocols are implemented using a modular, easy to use design. To use a protocol, just...

FLEA-2007-0057-1 pidgin

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Foresight Linux Essential Advisory: 2007-0057-1 Published: 2007-10-02 Rating: Minor Updated Versions: pidgin=/foresight.rpath.org@fl:1-devel//1/2.2.1-1-0.1 group-dist=/foresight.rpath.org@fl:1-devel//1/1.4.0-0.5-8 References:...