Hi, * Nico Golde <nion@xxxxxxxxxx> [2009-08-20 03:28]: > -------------------------------------------------------------------------- > Debian Security Advisory DSA-1870-1 security@xxxxxxxxxx > http://www.debian.org/security/ Nico Golde > August 19th, 2009 http://www.debian.org/security/faq > -------------------------------------------------------------------------- > > Package : pidgin > Vulnerability : insufficient input validation > Problem type : remote > Debian-specific: no > CVE ID : CVE-2009-2694 > > Federico Muttis discovered that libpurple, the shared library that adds > support for various instant messaging networks to the pidgin IM client, is > vulnerable to a heap-based buffer overflow. This issue exists because of > an incomplete fix for CVE-2008-2927 and CVE-2009-1376. An attacker can > exploit this by sending two consecutive SLP packets to a victim via MSN. [...] Sorry, just got used to writing that, this is no buffer overflow. Actually the attacker can write to almost any arbitrary location. Cheers Nico -- Nico Golde - JAB: nion@xxxxxxxxxxxxx | GPG: 0x73647CFF Forget about that mouse with 3/4/5 buttons - gimme a keyboard with 103/104/105 keys!
Attachment:
pgproIt2XZybN.pgp
Description: PGP signature
_______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/