PT-2009-1053 · Pidgin+1 · Libpurple+4

Josh Bressers · Published 2009-05-22 · Updated 2017-09-29 · CVE-2009-1374

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Pidgin versions prior to 2.5.6 libpurple-tcl versions prior to 2.5.6 libpurple-devel versions prior to 2.5.6 libpurple versions prior to 2.5.6

Description The issue is related to a buffer overflow in the decrypt out function, which allows remote attackers to cause a denial of service, resulting in an application crash. Multiple vulnerabilities in the libpurple package may lead to a breach of confidentiality, integrity, and availability of protected information. These vulnerabilities can be exploited remotely.

Recommendations For Pidgin versions prior to 2.5.6, update to version 2.5.6 or later. For libpurple-tcl versions prior to 2.5.6, update to version 2.5.6 or later. For libpurple-devel versions prior to 2.5.6, update to version 2.5.6 or later. For libpurple versions prior to 2.5.6, update to version 2.5.6 or later.

Fix

DoS

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

BDU:2015-06319

BDU:2015-06321

BDU:2015-06323

CVE-2009-1374

RHSA-2009:1060

RHSA-2009_1060

Affected Products

Pidgin

Red Hat

Libpurple

Libpurple-Devel

Libpurple-Tcl

References · 32

• https://bdu.fstec.ru/vul/2015-06319 · Security Note
• http://ubuntu.com/usn/USN-781-1 · Vendor Advisory
• http://mandriva.com/security/advisories?name=MDVSA-2009:173 · Vendor Advisory
• http://securityfocus.com/bid/35067 · Patch
• https://redhat.com/archives/fedora-package-announce/2009-June/msg00075.html · Vendor Advisory
• http://secunia.com/advisories/35202 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2009-1374 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2009-1374 · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-06323 · Security Note
• http://pidgin.im/news/security/?id=30 · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-06321 · Security Note
• https://redhat.com/archives/fedora-package-announce/2009-June/msg00051.html · Vendor Advisory
• https://redhat.com/archives/fedora-package-announce/2009-June/msg00033.html · Vendor Advisory
• http://secunia.com/advisories/35194 · Vendor Advisory
• http://redhat.com/support/errata/RHSA-2009-1060.html · Vendor Advisory