CVE Feed

    Dashboard / CVE / CVE-2009-2694

    CVE-2009-2694

    The msn_slplink_process_msg function in libpurple/protocols/msn/slplink.c in libpurple, as used in Pidgin (formerly Gaim) before 2.5.9 and Adium 1.3.5 and earlier, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) by sending multiple crafted SLP (aka MSNSLP) messages to trigger an overwrite of an arbitrary memory location. NOTE: this issue reportedly exists because of an incomplete fix for CVE-2009-1376.

    Published:Aug 18, 2009
    Last Modified:Apr 23, 2026
    EPS:Aug 20, 2009
    EPSS Score:0.34712
    CVSS Score:10

    Affected Products

    Vendor
    Adium
    Product
    Adium
    Vendor
    Pidgin
    Product
    Pidgin
    Vendor
    Redhat
    Product
    Enterprise Linux

    Exploits

    http://www.coresecurity.com/content/libpurple-arbitrary-writehttp://www.coresecurity.com/content/libpurple-arbitrary-writehttps://www.exploit-db.com/exploits/9615

    References

    http://developer.pidgin.im/viewmtn/revision/info/6f7343166c673bf0496ecb1afec9b633c1d54a0e
    http://developer.pidgin.im/wiki/ChangeLog
    http://secunia.com/advisories/36384
    http://secunia.com/advisories/36392
    http://secunia.com/advisories/36401
    http://secunia.com/advisories/36402
    http://secunia.com/advisories/36708
    http://secunia.com/advisories/37071
    http://sunsolve.sun.com/search/document.do?assetkey=1-66-266908-1
    http://www.coresecurity.com/content/libpurple-arbitrary-write
    http://www.debian.org/security/2009/dsa-1870
    http://www.exploit-db.com/exploits/9615
    http://www.pidgin.im/news/security/?id=34
    http://www.vupen.com/english/advisories/2009/2303
    http://www.vupen.com/english/advisories/2009/2663
    https://bugzilla.redhat.com/show_bug.cgi?id=514957
    https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10319
    https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6320
    https://rhn.redhat.com/errata/RHSA-2009-1218.html
    http://developer.pidgin.im/viewmtn/revision/info/6f7343166c673bf0496ecb1afec9b633c1d54a0e
    http://developer.pidgin.im/wiki/ChangeLog
    http://secunia.com/advisories/36384
    http://secunia.com/advisories/36392
    http://secunia.com/advisories/36401
    http://secunia.com/advisories/36402
    http://secunia.com/advisories/36708
    http://secunia.com/advisories/37071
    http://sunsolve.sun.com/search/document.do?assetkey=1-66-266908-1
    http://www.coresecurity.com/content/libpurple-arbitrary-write
    http://www.debian.org/security/2009/dsa-1870
    http://www.exploit-db.com/exploits/9615
    http://www.pidgin.im/news/security/?id=34
    http://www.vupen.com/english/advisories/2009/2303
    http://www.vupen.com/english/advisories/2009/2663
    https://bugzilla.redhat.com/show_bug.cgi?id=514957
    https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10319
    https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6320
    https://rhn.redhat.com/errata/RHSA-2009-1218.html

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High