exploit the possibilities
Home Files News &[SERVICES_TAB]About Contact Add New
Showing 1 - 6 of 6 RSS Feed

CVE-2010-0420

Status Candidate

Overview

libpurple in Finch in Pidgin before 2.6.6, when an XMPP multi-user chat (MUC) room is used, does not properly parse nicknames containing <br> sequences, which allows remote attackers to cause a denial of service (application crash) via a crafted nickname.

Related Files

Debian Security Advisory 2038-3
Posted Nov 15, 2010
Authored by Debian | Site debian.org

Debian Linux Security Advisory 2038-3 - The packages for Pidgin released as DSA 2038-2 had a regression, as they unintentionally disabled the Silc, Simple, and Yahoo instant messaging protocols. This update restore that functionality. Several remote vulnerabilities have been discovered in Pidgin, a multi protocol instant messaging client. Crafted nicknames in the XMPP protocol can crash Pidgin remotely. Remote contacts may send too many custom smilies, crashing Pidgin.

tags | advisory, remote, vulnerability, protocol
systems | linux, debian
advisories | CVE-2010-0420, CVE-2010-0423
SHA-256 | e167ab2c3a9029ef4b4afd8f25fc54a104528ce4117d118636049500e1ac4f42
Debian Linux Security Advisory 2038-2
Posted May 19, 2010
Authored by Debian | Site debian.org

Debian Linux Security Advisory 2038-2 - The packages for Pidgin released as DSA 2038-1 had a regression, as they unintentionally disabled the Zephyr instant messaging protocol. This update restores Zephyr functionality.

tags | advisory, protocol
systems | linux, debian
advisories | CVE-2010-0420, CVE-2010-0423
SHA-256 | 8844b20d4a2a86a5a509370b6538ede44062796995993449ec93b7d1753b774a
Mandriva Linux Security Advisory 2010-085
Posted Apr 28, 2010
Authored by Mandriva | Site mandriva.com

Mandriva Linux Security Advisory 2010-085 - The OSCAR protocol plugin in libpurple in Pidgin before 2.6.3 and Adium before 1.3.7 allows remote attackers to cause a denial of service (application crash) via crafted contact-list data for ICQ and possibly AIM, as demonstrated by the SIM IM client. Directory traversal vulnerability in slp.c in the MSN protocol plugin in libpurple in Pidgin 2.6.4 and Adium 1.3.8 allows remote attackers to read arbitrary files via a .. (dot dot) in an application/x-msnmsgrp2p MSN emoticon (aka custom smiley) request, a related issue to CVE-2004-0122. Directory traversal vulnerability in slp.c in the MSN protocol plugin in libpurple in Pidgin 2.6.4 and Adium 1.3.8 allows remote attackers to read arbitrary files via a .. (dot dot) in an application/x-msnmsgrp2p MSN emoticon (aka custom smiley) request, a related issue to CVE-2004-0122. Other issues have also been identified.

tags | advisory, remote, denial of service, arbitrary, protocol
systems | linux, mandriva
advisories | CVE-2009-3615, CVE-2010-0013, CVE-2010-0013, CVE-2010-0277, CVE-2010-0420, CVE-2010-0423
SHA-256 | 209643718e8208dbef837eae2a003ecf460b9808598317b3e97888b1d0d1d215
Debian Linux Security Advisory 2038-1
Posted Apr 19, 2010
Authored by Debian | Site debian.org

Debian Linux Security Advisory 2038-1 - Several remote vulnerabilities have been discovered in Pidgin, a multi protocol instant messaging client.

tags | advisory, remote, vulnerability, protocol
systems | linux, debian
advisories | CVE-2010-0420, CVE-2010-0423
SHA-256 | 1a90132295ee7fe139fe09b55a2bfc10846d8e660b12fc31aa7d62a279d8bf84
Ubuntu Security Notice 902-1
Posted Feb 23, 2010
Authored by Ubuntu | Site security.ubuntu.com

Ubuntu Security Notice 902-1 - Fabian Yamaguchi discovered that Pidgin incorrectly validated all fields of an incoming message in the MSN protocol handler. A remote attacker could send a specially crafted message and cause Pidgin to crash, leading to a denial of service. Sadrul Habib Chowdhury discovered that Pidgin incorrectly handled certain nicknames in Finch group chat rooms. A remote attacker could use a specially crafted nickname and cause Pidgin to crash, leading to a denial of service. Antti Hayrynen discovered that Pidgin incorrectly handled large numbers of smileys. A remote attacker could send a specially crafted message and cause Pidgin to become unresponsive, leading to a denial of service.

tags | advisory, remote, denial of service, protocol
systems | linux, ubuntu
advisories | CVE-2010-0277, CVE-2010-0420, CVE-2010-0423
SHA-256 | 35611ca76d703b9d1cdd647f16a07f7b90f473481b5e0afdd67eaee2f68d765b
Mandriva Linux Security Advisory 2010-041
Posted Feb 19, 2010
Authored by Mandriva | Site mandriva.com

Mandriva Linux Security Advisory 2010-041 - Multiple security vulnerabilities has been identified and fixed Certain malformed SLP messages can trigger a crash because the MSN protocol plugin fails to check that all pieces of the message are set correctly. In a user in a multi-user chat room has a nickname containing ' ' then libpurple ends up having two users with username ' ' in the room, and Finch crashes in this situation. We do not believe there is a possibility of remote code execution. oCERT notified us about a problem in Pidgin, where a large amount of processing time will be used when inserting many smileys into an IM or chat window. This should not cause a crash, but Pidgin can become unusable slow. Packages for 2008.0 are provided for Corporate Desktop 2008.0 customers. This update provides pidgin 2.6.6, which is not vulnerable to these issues.

tags | advisory, remote, vulnerability, code execution, protocol
systems | linux, mandriva
advisories | CVE-2010-0277, CVE-2010-0420, CVE-2010-0423
SHA-256 | fa9c0b2138d3b8fbc1ab0bfd2fde34bd63b64d1d1e05a2042455f5dfceb6006c
Page 1 of 1
Back1Next

File Archive:

August 2022

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Aug 1st
    20 Files
  • 2
    Aug 2nd
    4 Files
  • 3
    Aug 3rd
    6 Files
  • 4
    Aug 4th
    55 Files
  • 5
    Aug 5th
    16 Files
  • 6
    Aug 6th
    0 Files
  • 7
    Aug 7th
    0 Files
  • 8
    Aug 8th
    13 Files
  • 9
    Aug 9th
    0 Files
  • 10
    Aug 10th
    0 Files
  • 11
    Aug 11th
    0 Files
  • 12
    Aug 12th
    0 Files
  • 13
    Aug 13th
    0 Files
  • 14
    Aug 14th
    0 Files
  • 15
    Aug 15th
    0 Files
  • 16
    Aug 16th
    0 Files
  • 17
    Aug 17th
    0 Files
  • 18
    Aug 18th
    0 Files
  • 19
    Aug 19th
    0 Files
  • 20
    Aug 20th
    0 Files
  • 21
    Aug 21st
    0 Files
  • 22
    Aug 22nd
    0 Files
  • 23
    Aug 23rd
    0 Files
  • 24
    Aug 24th
    0 Files
  • 25
    Aug 25th
    0 Files
  • 26
    Aug 26th
    0 Files
  • 27
    Aug 27th
    0 Files
  • 28
    Aug 28th
    0 Files
  • 29
    Aug 29th
    0 Files
  • 30
    Aug 30th
    0 Files
  • 31
    Aug 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Hosting By
Rokasec
close