CVE-2010-4528 directconn.c in the MSN protocol plugin in libpurple 2.7.6 through 2.7.8 in Pidgin before 2.7.9 allows remote authenticated users to cause a denial of service (NULL pointer dereference and application...
MediumCVSS 4.0
EPSS 2.5%
- Published
- Updated
- Exploit status
- No public exploit known
Description
directconn.c in the MSN protocol plugin in libpurple 2.7.6 through 2.7.8 in Pidgin before 2.7.9 allows remote authenticated users to cause a denial of service (NULL pointer dereference and application crash) via a short p2pv2 packet in a DirectConnect (aka direct connection) session.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| pidgin libpurple | = 2.7.6 | No fix listed |
| pidgin libpurple | = 2.7.7 | No fix listed |
| pidgin libpurple | = 2.7.8 | No fix listed |
| pidgin | <= 2.7.8 | No fix listed |
| pidgin | = 2.0.0 | No fix listed |
| pidgin | = 2.0.1 | No fix listed |
| pidgin | = 2.0.2 | No fix listed |
| pidgin | = 2.1.0 | No fix listed |
| pidgin | = 2.1.1 | No fix listed |
| pidgin | = 2.2.0 | No fix listed |
| pidgin | = 2.2.1 | No fix listed |
| pidgin | = 2.2.2 | No fix listed |
| pidgin | = 2.3.0 | No fix listed |
| pidgin | = 2.3.1 | No fix listed |
| pidgin | = 2.4.0 | No fix listed |
| pidgin | = 2.4.1 | No fix listed |
| pidgin | = 2.4.2 | No fix listed |
| pidgin | = 2.4.3 | No fix listed |
| pidgin | = 2.5.0 | No fix listed |
| pidgin | = 2.5.1 | No fix listed |
| pidgin | = 2.5.2 | No fix listed |
| pidgin | = 2.5.3 | No fix listed |
| pidgin | = 2.5.4 | No fix listed |
| pidgin | = 2.5.5 | No fix listed |
| pidgin | = 2.5.6 | No fix listed |
Show 20 more
| Product | Affected versions | Fixed in |
|---|---|---|
| pidgin | = 2.5.7 | No fix listed |
| pidgin | = 2.5.8 | No fix listed |
| pidgin | = 2.5.9 | No fix listed |
| pidgin | = 2.6.0 | No fix listed |
| pidgin | = 2.6.1 | No fix listed |
| pidgin | = 2.6.2 | No fix listed |
| pidgin | = 2.6.4 | No fix listed |
| pidgin | = 2.6.5 | No fix listed |
| pidgin | = 2.6.6 | No fix listed |
| pidgin | = 2.7.0 | No fix listed |
| pidgin | = 2.7.1 | No fix listed |
| pidgin | = 2.7.2 | No fix listed |
| pidgin | = 2.7.3 | No fix listed |
| pidgin | = 2.7.4 | No fix listed |
| pidgin | = 2.7.5 | No fix listed |
| pidgin | = 2.7.6 | No fix listed |
| pidgin | = 2.7.7 | No fix listed |
| debian/pidgin(Debian:12) | < 2.7.9-1 | 2.7.9-1 |
| debian/pidgin(Debian:13) | < 2.7.9-1 | 2.7.9-1 |
| debian/pidgin(Debian:14) | < 2.7.9-1 | 2.7.9-1 |
References
- developer.pidgin.im patch
- developer.pidgin.im patch
- FEDORA-2010-19314 vendor-advisory
- FEDORA-2010-19317 vendor-advisory
- SUSE-SR:2011:001 vendor-advisory
- [support] 20101227 Pidgin 2.7.9 released mailing-list patch
- 42732 third-party-advisory vendor-advisory
- 42824 third-party-advisory vendor-advisory
- 42877 third-party-advisory
- MDVSA-2010:259 vendor-advisory
- [oss-security] 20101227 CVE Request -- Pidgin v2.7.6 <= x <= v2.7.8 -- MSN DirectConnect DoS (crash due NULL ptr dereference) after receiving a short P2P message mailing-list patch
- [oss-security] 20101231 Re: CVE Request -- Pidgin v2.7.6 <= x <= v2.7.8 -- MSN DirectConnect DoS (crash due NULL ptr dereference) after receiving a short P2P message mailing-list patch
- www.pidgin.im patch vendor-advisory
- 45581 vdb-entry
- ADV-2011-0028 vdb-entry vendor-advisory
- ADV-2011-0054 vdb-entry
- ADV-2011-0076 vdb-entry
- bugzilla.redhat.com
- oval:org.mitre.oval:def:18461 signature vdb-entry
- Debian Security Tracker CVE-2010-4528 vendor-advisory
- bugs.debian.org issue-tracking