PT-2008-1055 · Libpurple+2 · Libpurple+4
Juan Pablo Lopez Yacubian
·
Publicado
2008-07-01
·
Atualizado
2024-06-15
·
CVE-2008-2955
CVSS v2.0
6.8
Média
| Vetor | AV:N/AC:M/Au:N/C:P/I:P/A:P |
Name of the Vulnerable Software and Affected Versions
Pidgin version 2.4.1
libpurple-devel versions 2.5.2 and earlier
libpurple-tcl versions 2.5.2 and earlier
libpurple versions 2.5.2 and earlier
Description
The issue allows remote attackers to cause a denial of service, potentially leading to a crash, by sending a message with a long filename containing certain characters. This can be triggered in the
msn slplink process msg function. Multiple vulnerabilities in the libpurple package can lead to violations of confidentiality, integrity, and availability of protected information. These vulnerabilities can be exploited remotely.Recommendations
For Pidgin version 2.4.1, consider updating to a newer version to mitigate the risk.
For libpurple-devel versions 2.5.2 and earlier, restrict access to the
msn slplink process msg function until a patch is available.
For libpurple-tcl versions 2.5.2 and earlier, avoid using the vulnerable libpurple-tcl package until the issue is resolved.
For libpurple versions 2.5.2 and earlier, disable the vulnerable functions temporarily to minimize the risk of exploitation.
At the moment, there is no information about a newer version that contains a fix for this vulnerability.Exploit
DoS
RCE
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Pidgin
Red Hat
Libpurple
Libpurple-Devel
Libpurple-Tcl