Multiple integer overflows in the msn_slplink_process_msg functions in the MSN protocol handler in (1) libpurple/protocols/msn/slplink.c and (2) libpurple/protocols/msnp9/slplink.c in Pidgin before 2.4.3 and Adium before 1.3 allow remote attackers to execute arbitrary code via a malformed SLP message with a crafted offset value, a different vulnerability than CVE-2008-2955.
CVSS Details
- CVSS 3.1 Base Score: 9.8
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade pidgin | Jul 30, 2024 | Jul 7, 2008 |
| Gentoo Linux | — | Upgrade net-im/pidgin. | Oct 30, 2017 | Jul 7, 2008 |
| Suse | — | Upgrade pidginUpgrade libpurple-develUpgrade pidgin-develUpgrade libpurple-langUpgrade finch-develUpgrade finchUpgrade libpurple | Dec 12, 2013 | Jul 9, 2013 |
| Ubuntu | — | Upgrade pidginUpgrade gaim | Nov 8, 2024 | Jul 7, 2008 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub