CVE-2005-0473

CVE-2005-0473 affects the GAIM (Gaim) client prior to version 1.1.3. The issue arises in the HTML parsing code: processing malformed HTML can trigger an invalid memory access, leading to an application crash (DoS). Multiple connected advisories note the same flaw and reference 1.1.3 as the fixed ...

CVE-2004-0891

GAIM is affected by CVE-2004-0891: a buffer overflow in the MSN protocol handler (MSNSLP) for gaim versions 0.79 through 1.0.1, caused by an unbounded copy that writes to the wrong buffer during processing of an unexpected MSNSLP sequence. This can cause remote denial of service (crash) and poten...

CVE-2005-2370

CVE-2005-2370 refers to memory alignment errors in libgadu, exploited by processing an incoming message to trigger a denial of service on architectures such as SPARC. The vulnerability affects the libgadu-based components used by programs like ekg (before 1.6rc2) and Gaim (before 1.5.0), among ot...

CVE-2005-0472

Gaim (GAIM) before 1.1.3 is CERTified vulnerable to remote DoS via specially malformed SNAC packets from AIM/ICQ. The issue stems from SNAC packet processing that can trigger an infinite loop, causing the client to become unresponsive. Public reports reference CVE-2005-0472 (and related CAN/CVE m...

CVE-2004-0500

CVE-2004-0500 is a vulnerability in the MSN protocol plugins of Gaim (object.c and slp.c) where a misused strncpy call allows a remote attacker to trigger a buffer overflow. This can lead to a denial of service and may enable remote code execution. The description specifies the affected product a...

CVE-2004-0785

CVE-2004-0785 affects Gaim (pre-0.82). The advisory states multiple buffer overflows that allow remote attackers to cause denial of service and potentially execute arbitrary code via (1) RTF messages, (2) an excessively long hostname from DNS, or (3) an overly long URL not properly decoded. Produ...

CVE-2005-0965

CVE-2005-0965 affects the Gaim client. The description states a buffer/out-of-bounds read caused by the gaim_markup_strip_html function when processing malformed HTML, allowing remote attackers to trigger a denial of service (application crash) in Gaim 1.2.0 and possibly earlier versions. Public ...

CVE-2005-1934

GAIM (the multi-protocol instant messaging client) is affected. CVE-2005-1934 arises from processing a malformed MSN message that triggers an overly large memory allocation, likely due to an integer signedness error, causing the application to crash (denial of service). Multiple connected advisor...

CVE-2004-0008

GAIM (0.74 and earlier) and Ultramagnetic prior to 0.81 are affected by CVE-2004-0008 due to a heap-based overflow triggered by a DirectIM packet, allowing remote attackers to cause a denial of service and potentially execute arbitrary code. The issue is network-exploitable with no authentication...

CVE-2005-1261

CVE-2005-1261 is a stack-based buffer overflow in Gaim's URL parsing that affects versions before 1.3.0. A remote attacker could trigger arbitrary code execution by sending an IM containing a very large URL. Public disclosures and advisories (SUSE, OpenVAS/Gentoo, Mandrake/CentOS/Ubuntu/Nessus co...

CVE-2004-0007

CVE-2004-0007 affects instant messaging clients Gaim (GAIM) up to version 0.74 and Ultramagnetic before 0.81. The vulnerability is a buffer overflow in the Extract Info Field Function used by MSN and YMSG protocol handlers, allowing remote attackers to cause a denial of service and potentially ex...

CVE-2005-1269

CVE-2005-1269 affects Gaim prior to 1.3.1. A remote attacker can cause an application crash by sending a Yahoo! message with a non-ASCII filename, resulting in a denial of service. The issue is confirmed in multiple advisories referencing Gaim in affected packages; remediation is to upgrade to ve...

CVE-2004-0784

CVE-2004-0784 affects Gaim before 0.82. The flaw arises in the smiley theme: remote attackers can execute arbitrary commands through shell metacharacters embedded in the tar file name dragged to the smiley selector. Impact is arbitrary command execution with network access and no authentication; ...

CVE-2005-0208

The vulnerability CVE-2005-0208 affects the Gaim client HTML parser prior to version 1.1.4, where malformed HTML can trigger an invalid memory access and cause an application crash (DoS). This is the primary issue described (distinct from CVE-2005-0473). Remediation is upgrading Gaim to 1.1.4 or ...

CVE-2005-2102

CVE-2005-2102 affects the GAIM/ICQ module in Gaim prior to 1.5.0. A remote attacker can cause a denial of service (application crash) by sending a filename containing invalid UTF-8 characters. Mitigation: upgrade to Gaim 1.5.0 or newer (as indicated by multiple advisories in connected documents)....

CVE-2005-0967

Gaim 1.2.0 is affected by CVE-2005-0967. The issue occurs when handling a malformed file transfer request to a Jabber user, which leads to an out-of-bounds read and causes the application to crash (denial of service). The vulnerability focuses on Jabber message/file transfer parsing; no exploit d...

CVE-2004-0006

CVE-2004-0006 affects the IM client components in GAIM (aka Pidgin) 0.75 and earlier and Ultramagnetic before 0.81 . The vulnerability set consists of multiple buffer overflows in the Yahoo-related handling paths: (1) cookies in a Yahoo web connection, (2) a long name parameter in the Yahoo login...

CVE-2004-0754

CVE-2004-0754 affects Gaim prior to 0.82, where an integer overflow in the Groupware server messages size variable can cause denial of service and may allow arbitrary code execution. The vulnerability is documented across multiple feeds (SUSe/OpenVAS/Gentoo/Gaim advisories) with a base CVSS v2 of...

CVE-2005-0966

CVE-2005-0966 concerns the IRC protocol handling in Gaim (GAIM) 1.2.0 and possibly earlier. The vulnerability stems from how IRC messages are processed by the IRC protocol plugin, allowing remote attackers to inject arbitrary markup into the Gaim UI via functions such as irc_msg_kick, irc_msg_mod...

CVE-2000-1172

CVE-2000-1172 affects Gaim (formerly a...); specifically version 0.10.3 and earlier using the OSCAR protocol. The issue is a buffer overflow triggered by a long HTML tag in received messages, leading to remote denial of service and potentially arbitrary code execution. Exploitation details are no...

CVE-2002-0377

CVE-2002-0377 affects Gaim 0.57, where sensitive data is written to world-readable and group-writable files in /tmp, enabling local users to read authentication information and access MSN web email accounts of other users. The underlying issue is insecure file permissions leading to information d...

CVE-2004-2589

CVE-2004-2589 affects the Gaim client prior to version 0.82. A remote attacker can cause a denial of service (application crash) by sending a long HTTP Content-Length header, leading Gaim to abort while allocating memory. The published data indicate an impact on availability (partial), with netwo...

CVE-2005-1262

CVE-2005-1262 affects Gaim 1.2.1 and earlier. The issue allows remote attackers to cause a denial of service (application crash) by sending a malformed MSN message. Connected sources corroborate a separate but related buffer/URL handling flaw (CVE-2005-1261) and indicate updated packages to fix b...

CVE-2002-0384

CVE-2002-0384 stems from a buffer overflow in the Jabber plug-in of the Gaim client, affecting versions prior to 0.58. The issue enables remote code execution by an attacker via the Jabber plug-in. Public advisories (e.g., RHSA-2002:122) advise updating to 0.59 (or later), which is no longer vuln...

CVE-2002-0989

CVE-2002-0989 affects Gaim prior to 0.59.1. The vulnerability lies in the URL handler of the manual browser option, where a crafted link containing shell metacharacters can lead to remote command execution. References from Red Hat, Debian, Mandrake, and Red Hat advisories indicate updating to 0.5...

CVE-2005-0573

CVE-2005-0573 (Gaim 1.1.3 on Windows) is a remote-denial-of-service issue where a file transfer containing a filename with parentheses ("(" or ")") crashes the client. The vulnerability is documented in CVE/NVD with a base score of 5.0 (Medium) and a network attack vector with low complexity; no ...