The msn_slp_sip_recv function in libpurple/protocols/msn/slp.c in the MSN protocol plugin in libpurple in Pidgin before 2.6.2 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via an SLP invite message that lacks certain required fields, as demonstrated by a malformed message from a KMess client.
CVSS Details
- CVSS 3.1 Base Score: 7.5
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Centos_linux | — | Upgrade libpurple-perlUpgrade libpurpleUpgrade libpurple-develUpgrade pidgin-develUpgrade pidginUpgrade finchUpgrade libpurple-tclUpgrade finch-develUpgrade pidgin-perl | Dec 1, 2016 | Sep 8, 2009 |
| Debian | — | Upgrade pidgin | Jul 30, 2024 | Sep 8, 2009 |
| Suse | — | Upgrade pidgin-develUpgrade libogg0-x86Upgrade cdparanoia-x86Upgrade finch-develUpgrade libogg0-32bitUpgrade cdparanoia-32bitUpgrade liboil-32bitUpgrade pidginUpgrade libpurple-branding-upstreamUpgrade libpurple-langUpgrade liboilUpgrade libpurple-plugin-sametimeUpgrade libpurple-meanwhileUpgrade fam-x86Upgrade libpurpleUpgrade famUpgrade libpurple-develUpgrade cdparanoiaUpgrade gnome-vfs2Upgrade libogg0Upgrade gnome-vfs2-32bitUpgrade libpurple-tclUpgrade liboil-x86Upgrade desktop-file-utilsUpgrade gstreamer-0_10Upgrade finchUpgrade fam-32bitUpgrade gnome-vfs2-x86 | Feb 17, 2015 | Jun 28, 2013 |
| Ubuntu | — | Upgrade pidgin | Nov 8, 2024 | Sep 8, 2009 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub