The msn_slp_sip_recv function in libpurple/protocols/msn/slp.c in the MSN protocol plugin in libpurple in Pidgin before 2.6.2 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via an SLP invite message that lacks certain required fields, as demonstrated by a malformed message from a KMess client.
CVSS Details
- CVSS 3.1 Base Score: 7.5
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Centos_linux | — | Upgrade finchUpgrade pidginUpgrade finch-develUpgrade pidgin-perlUpgrade libpurple-tclUpgrade libpurpleUpgrade libpurple-develUpgrade pidgin-develUpgrade libpurple-perl | Dec 1, 2016 | Sep 8, 2009 |
| Debian | — | Upgrade pidgin | Jul 30, 2024 | Sep 8, 2009 |
| Suse | — | Upgrade pidgin-develUpgrade liboil-32bitUpgrade finch-develUpgrade pidginUpgrade cdparanoia-32bitUpgrade libpurple-branding-upstreamUpgrade libogg0-x86Upgrade cdparanoia-x86Upgrade libogg0-32bitUpgrade cdparanoiaUpgrade libpurple-langUpgrade gnome-vfs2Upgrade liboil-x86Upgrade famUpgrade gnome-vfs2-x86Upgrade libpurple-meanwhileUpgrade desktop-file-utilsUpgrade fam-x86Upgrade libpurpleUpgrade libpurple-develUpgrade liboilUpgrade libogg0Upgrade libpurple-plugin-sametimeUpgrade libpurple-tclUpgrade finchUpgrade gnome-vfs2-32bitUpgrade fam-32bitUpgrade gstreamer-0_10 | Feb 17, 2015 | Jun 28, 2013 |
| Ubuntu | — | Upgrade pidgin | Nov 8, 2024 | Sep 8, 2009 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub