CVE-2009-2694
NoneCVSS
—
EPSS
20.3%
Published
Aug 21, 2009
CISA due date
—
The record
The msn_slplink_process_msg function in libpurple/protocols/msn/slplink.c in libpurple, as used in Pidgin (formerly Gaim) before 2.5.9 and Adium 1.3.5 and earlier, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) by sending multiple crafted SLP (aka MSNSLP) messages to trigger an overwrite of an arbitrary memory location. NOTE: this issue reportedly exists because of an incomplete fix for CVE-2009-1376.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Debian:10 | pidgin | 0 | 2.5.9-1 |
| Debian:11 | pidgin | 0 | 2.5.9-1 |
| Debian:12 | pidgin | 0 | 2.5.9-1 |
| Debian:13 | pidgin | 0 | 2.5.9-1 |
| Debian:5.0 | pidgin | 0 | 2.4.3-4lenny3 |
| Red Hat:enterprise_linux:3::as | pidgin | 0 | 0:1.5.1-4.el3 |
| Red Hat:enterprise_linux:3::as | pidgin-debuginfo | 0 | 0:1.5.1-4.el3 |
| Red Hat:enterprise_linux:3::desktop | pidgin | 0 | 0:1.5.1-4.el3 |
| Red Hat:enterprise_linux:3::desktop | pidgin-debuginfo | 0 | 0:1.5.1-4.el3 |
| Red Hat:enterprise_linux:3::es | pidgin | 0 | 0:1.5.1-4.el3 |
| Red Hat:enterprise_linux:3::es | pidgin-debuginfo | 0 | 0:1.5.1-4.el3 |
| Red Hat:enterprise_linux:3::ws | pidgin | 0 | 0:1.5.1-4.el3 |
| Red Hat:enterprise_linux:3::ws | pidgin-debuginfo | 0 | 0:1.5.1-4.el3 |
| Red Hat:enterprise_linux:4::as | finch | 0 | 0:2.5.9-1.el4 |
| Red Hat:enterprise_linux:4::as | finch-devel | 0 | 0:2.5.9-1.el4 |
| Red Hat:enterprise_linux:4::as | libpurple | 0 | 0:2.5.9-1.el4 |
| Red Hat:enterprise_linux:4::as | libpurple-devel | 0 | 0:2.5.9-1.el4 |
| Red Hat:enterprise_linux:4::as | libpurple-perl | 0 | 0:2.5.9-1.el4 |
| Red Hat:enterprise_linux:4::as | libpurple-tcl | 0 | 0:2.5.9-1.el4 |
| Red Hat:enterprise_linux:4::as | pidgin | 0 | 0:2.5.9-1.el4 |
| Red Hat:enterprise_linux:4::as | pidgin-debuginfo | 0 | 0:2.5.9-1.el4 |
| Red Hat:enterprise_linux:4::as | pidgin-devel | 0 | 0:2.5.9-1.el4 |
| Red Hat:enterprise_linux:4::as | pidgin-perl | 0 | 0:2.5.9-1.el4 |
| Red Hat:enterprise_linux:4::desktop | finch | 0 | 0:2.5.9-1.el4 |
| Red Hat:enterprise_linux:4::desktop | finch-devel | 0 | 0:2.5.9-1.el4 |
| Red Hat:enterprise_linux:4::desktop | libpurple | 0 | 0:2.5.9-1.el4 |
| Red Hat:enterprise_linux:4::desktop | libpurple-devel | 0 | 0:2.5.9-1.el4 |
| Red Hat:enterprise_linux:4::desktop | libpurple-perl | 0 | 0:2.5.9-1.el4 |
| Red Hat:enterprise_linux:4::desktop | libpurple-tcl | 0 | 0:2.5.9-1.el4 |
| Red Hat:enterprise_linux:4::desktop | pidgin | 0 | 0:2.5.9-1.el4 |
| Red Hat:enterprise_linux:4::desktop | pidgin-debuginfo | 0 | 0:2.5.9-1.el4 |
| Red Hat:enterprise_linux:4::desktop | pidgin-devel | 0 | 0:2.5.9-1.el4 |
| Red Hat:enterprise_linux:4::desktop | pidgin-perl | 0 | 0:2.5.9-1.el4 |
| Red Hat:enterprise_linux:4::es | finch | 0 | 0:2.5.9-1.el4 |
| Red Hat:enterprise_linux:4::es | finch-devel | 0 | 0:2.5.9-1.el4 |
| Red Hat:enterprise_linux:4::es | libpurple | 0 | 0:2.5.9-1.el4 |
| Red Hat:enterprise_linux:4::es | libpurple-devel | 0 | 0:2.5.9-1.el4 |
| Red Hat:enterprise_linux:4::es | libpurple-perl | 0 | 0:2.5.9-1.el4 |
| Red Hat:enterprise_linux:4::es | libpurple-tcl | 0 | 0:2.5.9-1.el4 |
| Red Hat:enterprise_linux:4::es | pidgin | 0 | 0:2.5.9-1.el4 |
| Red Hat:enterprise_linux:4::es | pidgin-debuginfo | 0 | 0:2.5.9-1.el4 |
| Red Hat:enterprise_linux:4::es | pidgin-devel | 0 | 0:2.5.9-1.el4 |
| Red Hat:enterprise_linux:4::es | pidgin-perl | 0 | 0:2.5.9-1.el4 |
| Red Hat:enterprise_linux:4::ws | finch | 0 | 0:2.5.9-1.el4 |
| Red Hat:enterprise_linux:4::ws | finch-devel | 0 | 0:2.5.9-1.el4 |
| Red Hat:enterprise_linux:4::ws | libpurple | 0 | 0:2.5.9-1.el4 |
| Red Hat:enterprise_linux:4::ws | libpurple-devel | 0 | 0:2.5.9-1.el4 |
| Red Hat:enterprise_linux:4::ws | libpurple-perl | 0 | 0:2.5.9-1.el4 |
| Red Hat:enterprise_linux:4::ws | libpurple-tcl | 0 | 0:2.5.9-1.el4 |
| Red Hat:enterprise_linux:4::ws | pidgin | 0 | 0:2.5.9-1.el4 |
| Red Hat:enterprise_linux:4::ws | pidgin-debuginfo | 0 | 0:2.5.9-1.el4 |
| Red Hat:enterprise_linux:4::ws | pidgin-devel | 0 | 0:2.5.9-1.el4 |
| Red Hat:enterprise_linux:4::ws | pidgin-perl | 0 | 0:2.5.9-1.el4 |
| Red Hat:enterprise_linux:5::client | finch | 0 | 0:2.5.9-1.el5 |
| Red Hat:enterprise_linux:5::client | finch-devel | 0 | 0:2.5.9-1.el5 |
| Red Hat:enterprise_linux:5::client | libpurple | 0 | 0:2.5.9-1.el5 |
| Red Hat:enterprise_linux:5::client | libpurple-devel | 0 | 0:2.5.9-1.el5 |
| Red Hat:enterprise_linux:5::client | libpurple-perl | 0 | 0:2.5.9-1.el5 |
| Red Hat:enterprise_linux:5::client | libpurple-tcl | 0 | 0:2.5.9-1.el5 |
| Red Hat:enterprise_linux:5::client | pidgin | 0 | 0:2.5.9-1.el5 |
| Red Hat:enterprise_linux:5::client | pidgin-debuginfo | 0 | 0:2.5.9-1.el5 |
| Red Hat:enterprise_linux:5::client | pidgin-devel | 0 | 0:2.5.9-1.el5 |
| Red Hat:enterprise_linux:5::client | pidgin-perl | 0 | 0:2.5.9-1.el5 |
| Red Hat:enterprise_linux:5::client_workstation | finch | 0 | 0:2.5.9-1.el5 |
| Red Hat:enterprise_linux:5::client_workstation | finch-devel | 0 | 0:2.5.9-1.el5 |
| Red Hat:enterprise_linux:5::client_workstation | libpurple | 0 | 0:2.5.9-1.el5 |
| Red Hat:enterprise_linux:5::client_workstation | libpurple-devel | 0 | 0:2.5.9-1.el5 |
| Red Hat:enterprise_linux:5::client_workstation | libpurple-perl | 0 | 0:2.5.9-1.el5 |
| Red Hat:enterprise_linux:5::client_workstation | libpurple-tcl | 0 | 0:2.5.9-1.el5 |
| Red Hat:enterprise_linux:5::client_workstation | pidgin | 0 | 0:2.5.9-1.el5 |
| Red Hat:enterprise_linux:5::client_workstation | pidgin-debuginfo | 0 | 0:2.5.9-1.el5 |
| Red Hat:enterprise_linux:5::client_workstation | pidgin-devel | 0 | 0:2.5.9-1.el5 |
| Red Hat:enterprise_linux:5::client_workstation | pidgin-perl | 0 | 0:2.5.9-1.el5 |
| Red Hat:rhel_productivity:5 | finch | 0 | 0:2.5.9-1.el5 |
| Red Hat:rhel_productivity:5 | finch-devel | 0 | 0:2.5.9-1.el5 |
| Red Hat:rhel_productivity:5 | libpurple | 0 | 0:2.5.9-1.el5 |
| Red Hat:rhel_productivity:5 | libpurple-devel | 0 | 0:2.5.9-1.el5 |
| Red Hat:rhel_productivity:5 | libpurple-perl | 0 | 0:2.5.9-1.el5 |
| Red Hat:rhel_productivity:5 | libpurple-tcl | 0 | 0:2.5.9-1.el5 |
| Red Hat:rhel_productivity:5 | pidgin | 0 | 0:2.5.9-1.el5 |
| Red Hat:rhel_productivity:5 | pidgin-debuginfo | 0 | 0:2.5.9-1.el5 |
| Red Hat:rhel_productivity:5 | pidgin-devel | 0 | 0:2.5.9-1.el5 |
| Red Hat:rhel_productivity:5 | pidgin-perl | 0 | 0:2.5.9-1.el5 |
Related vulnerabilities
- CVE-2010-0013 Directory traversal vulnerability in slp.c in the MSN protocol plugin in libpurple in… Also affects pidgin
- CVE-2022-26491 An issue was discovered in Pidgin before 2.14.9. Also affects pidgin
- CVE-2016-2365 A denial of service vulnerability exists in the handling of the MXIT protocol in Pidgin. Also affects pidgin
- CVE-2014-3694 The (1) bundled GnuTLS SSL/TLS plugin and the (2) bundled OpenSSL SSL/TLS plugin in… Also affects pidgin
- CVE-2013-6490 The SIMPLE protocol functionality in Pidgin before 2.10.8 allows remote attackers to have… Also affects pidgin
- CVE-2009-1376 Multiple integer overflows in the msn_slplink_process_msg functions in the MSN protocol… Also affects pidgin
- CVE-2026-41983 Null pointer dereference vulnerability in the browser module. Impact: Successful… CWE-399
- CVE-2015-9252 An issue was discovered in QPDF before 7.0.0. CWE-399