-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hi, * Nico Golde <n...@debian.org> [2009-08-20 00:37]: > -------------------------------------------------------------------------- > Debian Security Advisory DSA-1870-1 secur...@debian.org > http://www.debian.org/security/ Nico Golde > August 19th, 2009 http://www.debian.org/security/faq > -------------------------------------------------------------------------- > > Package : pidgin > Vulnerability : insufficient input validation > Problem type : remote > Debian-specific: no > CVE ID : CVE-2009-2694 > > Federico Muttis discovered that libpurple, the shared library that adds > support for various instant messaging networks to the pidgin IM client, is > vulnerable to a heap-based buffer overflow. This issue exists because of > an incomplete fix for CVE-2008-2927 and CVE-2009-1376. An attacker can > exploit this by sending two consecutive SLP packets to a victim via MSN. [...] Sorry, just got used to writing that, this is no buffer overflow. Actually the attacker can write to almost any arbitrary location.
Cheers Nico - -- Nico Golde - http://www.ngolde.de - n...@jabber.ccc.de - GPG: 0xA0A0AAAA For security reasons, all text in this mail is double-rot13 encrypted. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.9 (GNU/Linux) iEYEARECAAYFAkqMpIYACgkQHYflSXNkfP8yzQCeNsWUmK/SXSdvc+iCpP0+fFac DikAoKqaQ1FO+pjF/V6APnNV+pNx5bID =oDeT -----END PGP SIGNATURE----- -- To UNSUBSCRIBE, email to debian-security-requ...@lists.debian.org with a subject of "unsubscribe". Trouble? Contact listmas...@lists.debian.org
