CVE-2009-1376
NoneCVSS
—
EPSS
13.3%
Published
May 26, 2009
CISA due date
—
The record
Multiple integer overflows in the msn_slplink_process_msg functions in the MSN protocol handler in (1) libpurple/protocols/msn/slplink.c and (2) libpurple/protocols/msnp9/slplink.c in Pidgin (formerly Gaim) before 2.5.6 on 32-bit platforms allow remote attackers to execute arbitrary code via a malformed SLP message with a crafted offset value, leading to buffer overflows. NOTE: this issue exists because of an incomplete fix for CVE-2008-2927.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Debian:11 | pidgin | 0 | 2.5.6-1 |
| Debian:12 | pidgin | 0 | 2.5.6-1 |
| Debian:13 | pidgin | 0 | 2.5.6-1 |
| Debian:5.0 | pidgin | 0 | 2.4.3-4lenny2 |
| Red Hat:enterprise_linux:3::as | pidgin | 0 | 0:1.5.1-3.el3 |
| Red Hat:enterprise_linux:3::as | pidgin-debuginfo | 0 | 0:1.5.1-3.el3 |
| Red Hat:enterprise_linux:3::desktop | pidgin | 0 | 0:1.5.1-3.el3 |
| Red Hat:enterprise_linux:3::desktop | pidgin-debuginfo | 0 | 0:1.5.1-3.el3 |
| Red Hat:enterprise_linux:3::es | pidgin | 0 | 0:1.5.1-3.el3 |
| Red Hat:enterprise_linux:3::es | pidgin-debuginfo | 0 | 0:1.5.1-3.el3 |
| Red Hat:enterprise_linux:3::ws | pidgin | 0 | 0:1.5.1-3.el3 |
| Red Hat:enterprise_linux:3::ws | pidgin-debuginfo | 0 | 0:1.5.1-3.el3 |
| Red Hat:enterprise_linux:4::as | finch | 0 | 0:2.5.5-2.el4 |
| Red Hat:enterprise_linux:4::as | finch-devel | 0 | 0:2.5.5-2.el4 |
| Red Hat:enterprise_linux:4::as | libpurple | 0 | 0:2.5.5-2.el4 |
| Red Hat:enterprise_linux:4::as | libpurple-devel | 0 | 0:2.5.5-2.el4 |
| Red Hat:enterprise_linux:4::as | libpurple-perl | 0 | 0:2.5.5-2.el4 |
| Red Hat:enterprise_linux:4::as | libpurple-tcl | 0 | 0:2.5.5-2.el4 |
| Red Hat:enterprise_linux:4::as | pidgin | 0 | 0:2.5.5-2.el4 |
| Red Hat:enterprise_linux:4::as | pidgin-debuginfo | 0 | 0:2.5.5-2.el4 |
| Red Hat:enterprise_linux:4::as | pidgin-devel | 0 | 0:2.5.5-2.el4 |
| Red Hat:enterprise_linux:4::as | pidgin-perl | 0 | 0:2.5.5-2.el4 |
| Red Hat:enterprise_linux:4::desktop | finch | 0 | 0:2.5.5-2.el4 |
| Red Hat:enterprise_linux:4::desktop | finch-devel | 0 | 0:2.5.5-2.el4 |
| Red Hat:enterprise_linux:4::desktop | libpurple | 0 | 0:2.5.5-2.el4 |
| Red Hat:enterprise_linux:4::desktop | libpurple-devel | 0 | 0:2.5.5-2.el4 |
| Red Hat:enterprise_linux:4::desktop | libpurple-perl | 0 | 0:2.5.5-2.el4 |
| Red Hat:enterprise_linux:4::desktop | libpurple-tcl | 0 | 0:2.5.5-2.el4 |
| Red Hat:enterprise_linux:4::desktop | pidgin | 0 | 0:2.5.5-2.el4 |
| Red Hat:enterprise_linux:4::desktop | pidgin-debuginfo | 0 | 0:2.5.5-2.el4 |
| Red Hat:enterprise_linux:4::desktop | pidgin-devel | 0 | 0:2.5.5-2.el4 |
| Red Hat:enterprise_linux:4::desktop | pidgin-perl | 0 | 0:2.5.5-2.el4 |
| Red Hat:enterprise_linux:4::es | finch | 0 | 0:2.5.5-2.el4 |
| Red Hat:enterprise_linux:4::es | finch-devel | 0 | 0:2.5.5-2.el4 |
| Red Hat:enterprise_linux:4::es | libpurple | 0 | 0:2.5.5-2.el4 |
| Red Hat:enterprise_linux:4::es | libpurple-devel | 0 | 0:2.5.5-2.el4 |
| Red Hat:enterprise_linux:4::es | libpurple-perl | 0 | 0:2.5.5-2.el4 |
| Red Hat:enterprise_linux:4::es | libpurple-tcl | 0 | 0:2.5.5-2.el4 |
| Red Hat:enterprise_linux:4::es | pidgin | 0 | 0:2.5.5-2.el4 |
| Red Hat:enterprise_linux:4::es | pidgin-debuginfo | 0 | 0:2.5.5-2.el4 |
| Red Hat:enterprise_linux:4::es | pidgin-devel | 0 | 0:2.5.5-2.el4 |
| Red Hat:enterprise_linux:4::es | pidgin-perl | 0 | 0:2.5.5-2.el4 |
| Red Hat:enterprise_linux:4::ws | finch | 0 | 0:2.5.5-2.el4 |
| Red Hat:enterprise_linux:4::ws | finch-devel | 0 | 0:2.5.5-2.el4 |
| Red Hat:enterprise_linux:4::ws | libpurple | 0 | 0:2.5.5-2.el4 |
| Red Hat:enterprise_linux:4::ws | libpurple-devel | 0 | 0:2.5.5-2.el4 |
| Red Hat:enterprise_linux:4::ws | libpurple-perl | 0 | 0:2.5.5-2.el4 |
| Red Hat:enterprise_linux:4::ws | libpurple-tcl | 0 | 0:2.5.5-2.el4 |
| Red Hat:enterprise_linux:4::ws | pidgin | 0 | 0:2.5.5-2.el4 |
| Red Hat:enterprise_linux:4::ws | pidgin-debuginfo | 0 | 0:2.5.5-2.el4 |
| Red Hat:enterprise_linux:4::ws | pidgin-devel | 0 | 0:2.5.5-2.el4 |
| Red Hat:enterprise_linux:4::ws | pidgin-perl | 0 | 0:2.5.5-2.el4 |
| Red Hat:enterprise_linux:5::client | finch | 0 | 0:2.5.5-3.el5 |
| Red Hat:enterprise_linux:5::client | finch-devel | 0 | 0:2.5.5-3.el5 |
| Red Hat:enterprise_linux:5::client | libpurple | 0 | 0:2.5.5-3.el5 |
| Red Hat:enterprise_linux:5::client | libpurple-devel | 0 | 0:2.5.5-3.el5 |
| Red Hat:enterprise_linux:5::client | libpurple-perl | 0 | 0:2.5.5-3.el5 |
| Red Hat:enterprise_linux:5::client | libpurple-tcl | 0 | 0:2.5.5-3.el5 |
| Red Hat:enterprise_linux:5::client | pidgin | 0 | 0:2.5.5-3.el5 |
| Red Hat:enterprise_linux:5::client | pidgin-debuginfo | 0 | 0:2.5.5-3.el5 |
| Red Hat:enterprise_linux:5::client | pidgin-devel | 0 | 0:2.5.5-3.el5 |
| Red Hat:enterprise_linux:5::client | pidgin-perl | 0 | 0:2.5.5-3.el5 |
| Red Hat:enterprise_linux:5::client_workstation | finch | 0 | 0:2.5.5-3.el5 |
| Red Hat:enterprise_linux:5::client_workstation | finch-devel | 0 | 0:2.5.5-3.el5 |
| Red Hat:enterprise_linux:5::client_workstation | libpurple | 0 | 0:2.5.5-3.el5 |
| Red Hat:enterprise_linux:5::client_workstation | libpurple-devel | 0 | 0:2.5.5-3.el5 |
| Red Hat:enterprise_linux:5::client_workstation | libpurple-perl | 0 | 0:2.5.5-3.el5 |
| Red Hat:enterprise_linux:5::client_workstation | libpurple-tcl | 0 | 0:2.5.5-3.el5 |
| Red Hat:enterprise_linux:5::client_workstation | pidgin | 0 | 0:2.5.5-3.el5 |
| Red Hat:enterprise_linux:5::client_workstation | pidgin-debuginfo | 0 | 0:2.5.5-3.el5 |
| Red Hat:enterprise_linux:5::client_workstation | pidgin-devel | 0 | 0:2.5.5-3.el5 |
| Red Hat:enterprise_linux:5::client_workstation | pidgin-perl | 0 | 0:2.5.5-3.el5 |
Related vulnerabilities
- CVE-2022-26491 An issue was discovered in Pidgin before 2.14.9. Also affects pidgin
- CVE-2016-2365 A denial of service vulnerability exists in the handling of the MXIT protocol in Pidgin. Also affects pidgin
- CVE-2014-3694 The (1) bundled GnuTLS SSL/TLS plugin and the (2) bundled OpenSSL SSL/TLS plugin in… Also affects pidgin
- CVE-2013-6490 The SIMPLE protocol functionality in Pidgin before 2.10.8 allows remote attackers to have… Also affects pidgin
- CVE-2010-0013 Directory traversal vulnerability in slp.c in the MSN protocol plugin in libpurple in… Also affects pidgin
- CVE-2009-2694 The msn_slplink_process_msg function in libpurple/protocols/msn/slplink.c in libpurple… Also affects pidgin
- CVE-2026-102621 A vulnerability was identified in Freedesktop Poppler up to 26.08.0. CWE-189
- CVE-2026-102620 A vulnerability was determined in Freedesktop Poppler 26.06.0/26.07.0/26.08.0. CWE-189