The msn_slp_process_msg function in libpurple/protocols/msn/slpcall.c in the MSN protocol plugin in libpurple 2.6.0 and 2.6.1, as used in Pidgin before 2.6.2, allows remote attackers to cause a denial of service (application crash) via a handwritten (aka Ink) message, related to an uninitialized variable and the incorrect "UTF16-LE" charset name.
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade pidgin | Jul 30, 2024 | Sep 8, 2009 |
| Suse | — | Upgrade libpurple-plugin-sametimeUpgrade libpurple-langUpgrade libogg0-x86Upgrade cdparanoiaUpgrade libpurple-branding-upstreamUpgrade gnome-vfs2-x86Upgrade liboil-x86Upgrade gnome-vfs2-32bitUpgrade pidgin-develUpgrade desktop-file-utilsUpgrade cdparanoia-32bitUpgrade finch-develUpgrade cdparanoia-x86Upgrade libpurpleUpgrade libogg0Upgrade gstreamer-0_10Upgrade pidginUpgrade gnome-vfs2Upgrade libpurple-tclUpgrade liboilUpgrade finchUpgrade fam-x86Upgrade liboil-32bitUpgrade libpurple-meanwhileUpgrade fam-32bitUpgrade famUpgrade libpurple-develUpgrade libogg0-32bit | Feb 17, 2015 | Jun 28, 2013 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub