NVD

Id
49935  
Name
CVE-2009-2694  
Description
The msn_slplink_process_msg function in libpurple/protocols/msn/slplink.c in libpurple, as used in Pidgin (formerly Gaim) before 2.5.9 and Adium 1.3.5 and earlier, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) by sending multiple crafted SLP (aka MSNSLP) messages to trigger an overwrite of an arbitrary memory location. NOTE: this issue reportedly exists because of an incomplete fix for CVE-2009-1376.  
Reject
 
CVSS Version
2  
CVSS Score
10  
Severity
High  
CVSS Base Score
10  
CVSS Impact Subscore
10  
CVSS Exploit Subscore
10  
CVSS Vector
(AV:N/AC:L/Au:N/C:C/I:C/A:C)  
Pub Date
2017-01-07  
Published
2009-08-21  
Modified Date
2012-10-22  
Seq
2009-2694  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
252666 49935 CVE-2009-2694 http://developer.pidgin.im/viewmtn/revision/info/6f7343166c673bf0496ecb1afec9b633c1d54a0e  View
252667 49935 CVE-2009-2694 http://developer.pidgin.im/wiki/ChangeLog  View
252668 49935 CVE-2009-2694 oval:org.mitre.oval:def:10319  View
252669 49935 CVE-2009-2694 oval:org.mitre.oval:def:6320  View
252670 49935 CVE-2009-2694 266908  View
252671 49935 CVE-2009-2694 http://www.coresecurity.com/content/libpurple-arbitrary-write  View
252672 49935 CVE-2009-2694 DSA-1870  View
252673 49935 CVE-2009-2694 9615  View
252674 49935 CVE-2009-2694 http://www.pidgin.im/news/security/?id=34  View
252675 49935 CVE-2009-2694 ADV-2009-2303  View
252676 49935 CVE-2009-2694 ADV-2009-2663  View
252677 49935 CVE-2009-2694 https://bugzilla.redhat.com/show_bug.cgi?id=514957  View
252678 49935 CVE-2009-2694 RHSA-2009:1218  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
41041 JVNDB-2009-002048 libpurple における任意のコードを実行される脆弱性 Pidgin などで使用されている libpurple にある msn_slplink_process_msg 関数には、複数の SLP メッセージを送信されることにより任意のコードを実行される、またはサービス運用妨害 (DoS) となる脆弱性が存在します。 CVE-2009-2694 40125 CVE-2009-2694 49935 10 http://jvndb.jvn.jp/ja/contents/2009/JVNDB-2009-002048.html 2009-08-18 2009-10-01 View