Privacy."> OVAL Reference oval:org.mitre.oval:def:8129 - CERT Civis.Net
Oval Definition:oval:org.mitre.oval:def:8129
Revision Date:2014-06-23Version:19
Title:DSA-1870 pidgin -- insufficient input validation
Description:Federico Muttis discovered that libpurple, the shared library that adds support for various instant messaging networks to the pidgin IM client, is vulnerable to a heap-based buffer overflow. This issue exists because of an incomplete fix for CVE-2008-2927 and CVE-2009-1376. An attacker can exploit this by sending two consecutive SLP packets to a victim via MSN. The first packet is used to create an SLP message object with an offset of zero, the second packet then contains a crafted offset, which hits the vulnerable code originally fixed in CVE-2008-2927 and CVE-2009-1376, and allows an attacker to execute arbitrary code. Note: Users with the "Allow only the users below" setting are not vulnerable to this attack. If you can't install the below updates you may want to set this via Tools->Privacy.
Family:unixClass:patch
Status:ACCEPTEDReference(s):CVE-2008-2927
CVE-2009-1376
CVE-2009-2694
DSA-1870
Platform(s):Debian GNU/Linux 5.0
Product(s):pidgin
Definition Synopsis
  • Debian GNU/Linux 5.0 is installed
  • AND Architecture section
  • Architecture independent section
  • Installed architecture is all
  • AND Packages section
  • libpurple-dev is earlier than 2.4.3-4lenny3
  • OR finch-dev is earlier than 2.4.3-4lenny3
  • OR pidgin-dev is earlier than 2.4.3-4lenny3
  • OR libpurple-bin is earlier than 2.4.3-4lenny3
  • OR pidgin-data is earlier than 2.4.3-4lenny3
  • OR Architecture dependent section
  • Supported architectures section
  • Installed architecture is amd64
  • OR Installed architecture is arm
  • OR Installed architecture is i386
  • OR Installed architecture is armel
  • OR Installed architecture is mips
  • OR Installed architecture is ia64
  • OR Installed architecture is alpha
  • OR Installed architecture is powerpc
  • OR Installed architecture is hppa
  • AND Packages section
  • libpurple0 is earlier than 2.4.3-4lenny3
  • OR pidgin-dbg is earlier than 2.4.3-4lenny3
  • OR pidgin is earlier than 2.4.3-4lenny3
  • OR finch is earlier than 2.4.3-4lenny3
  • BACK