CVE-2009-3615
published 2009-10-20CVE-2009-3615: The OSCAR protocol plugin in libpurple in Pidgin before 2.6.3 and Adium before 1.3.7 allows remote attackers to cause a denial of service (application crash)…
PriorityP421medium5CVSS 2.0
AVNACLAuNCNINAP
EPSS
2.66%
84.1th percentile
The OSCAR protocol plugin in libpurple in Pidgin before 2.6.3 and Adium before 1.3.7 allows remote attackers to cause a denial of service (application crash) via crafted contact-list data for (1) ICQ and possibly (2) AIM, as demonstrated by the SIM IM client.
Affected
51 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| adium | adium | <= 1.3.6 | — |
| adium | adium | — | — |
| adium | adium | — | — |
| adium | adium | — | — |
| adium | adium | — | — |
| adium | adium | — | — |
| adium | adium | — | — |
| adium | adium | — | — |
| adium | adium | — | — |
| adium | adium | — | — |
| adium | adium | — | — |
| adium | adium | — | — |
| adium | adium | — | — |
| adium | adium | — | — |
| adium | adium | — | — |
| adium | adium | — | — |
| adium | adium | — | — |
| adium | adium | — | — |
| adium | adium | — | — |
| debian | pidgin | < pidgin 2.6.3-1 (bookworm) | pidgin 2.6.3-1 (bookworm) |
| pidgin | pidgin | <= 2.6.2 | — |
| pidgin | pidgin | — | — |
| pidgin | pidgin | — | — |
| pidgin | pidgin | — | — |
| pidgin | pidgin | — | — |
CVSS provenance
nvdv2.05.0MEDIUMAV:N/AC:L/Au:N/C:N/I:N/A:P
osv5.0MEDIUM
vendor_debian5.0MEDIUM
vendor_redhat5.0MEDIUM
vendor_ubuntu5.0MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-vj8h-wj7f-5mcf: The OSCAR protocol plugin in libpurple in Pidgin before 2
ghsa_unreviewed·2022-05-02
CVE-2009-3615 [MEDIUM] GHSA-vj8h-wj7f-5mcf: The OSCAR protocol plugin in libpurple in Pidgin before 2
The OSCAR protocol plugin in libpurple in Pidgin before 2.6.3 and Adium before 1.3.7 allows remote attackers to cause a denial of service (application crash) via crafted contact-list data for (1) ICQ and possibly (2) AIM, as demonstrated by the SIM IM client.
OSV
CVE-2009-3615: The OSCAR protocol plugin in libpurple in Pidgin before 2
osv·2009-10-20·CVSS 5.0
CVE-2009-3615 [MEDIUM] CVE-2009-3615: The OSCAR protocol plugin in libpurple in Pidgin before 2
The OSCAR protocol plugin in libpurple in Pidgin before 2.6.3 and Adium before 1.3.7 allows remote attackers to cause a denial of service (application crash) via crafted contact-list data for (1) ICQ and possibly (2) AIM, as demonstrated by the SIM IM client.
Ubuntu
Pidgin vulnerabilities
vendor_ubuntu·2010-01-18·CVSS 5.0
CVE-2008-2955 [MEDIUM] Pidgin vulnerabilities
Title: Pidgin vulnerabilities
Summary: Pidgin vulnerabilities
It was discovered that Pidgin did not properly handle certain topic
messages in the IRC protocol handler. If a user were tricked into
connecting to a malicious IRC server, an attacker could cause Pidgin to
crash, leading to a denial of service. This issue only affected Ubuntu 8.04
LTS, Ubuntu 8.10 and Ubuntu 9.04. (CVE-2009-2703)
It was discovered that Pidgin did not properly enforce the "require
TLS/SSL" setting when connecting to certain older Jabber servers. If a
remote attacker were able to perform a machine-in-the-middle attack, this flaw
could be exploited to view sensitive information. This issue only affected
Ubuntu 8.04 LTS, Ubuntu 8.10 and Ubuntu 9.04. (CVE-2009-3026)
It was discovered that Pidgin did not properly
Red Hat
Pidgin: Invalid pointer dereference (crash) after receiving contacts from SIM IM client
vendor_redhat·2009-10-10·CVSS 5.0
CVE-2009-3615 [MEDIUM] Pidgin: Invalid pointer dereference (crash) after receiving contacts from SIM IM client
Pidgin: Invalid pointer dereference (crash) after receiving contacts from SIM IM client
The OSCAR protocol plugin in libpurple in Pidgin before 2.6.3 and Adium before 1.3.7 allows remote attackers to cause a denial of service (application crash) via crafted contact-list data for (1) ICQ and possibly (2) AIM, as demonstrated by the SIM IM client.
Debian
CVE-2009-3615: pidgin - The OSCAR protocol plugin in libpurple in Pidgin before 2.6.3 and Adium before 1...
vendor_debian·2009·CVSS 5.0
CVE-2009-3615 [MEDIUM] CVE-2009-3615: pidgin - The OSCAR protocol plugin in libpurple in Pidgin before 2.6.3 and Adium before 1...
The OSCAR protocol plugin in libpurple in Pidgin before 2.6.3 and Adium before 1.3.7 allows remote attackers to cause a denial of service (application crash) via crafted contact-list data for (1) ICQ and possibly (2) AIM, as demonstrated by the SIM IM client.
Scope: local
bookworm: resolved (fixed in 2.6.3-1)
bullseye: resolved (fixed in 2.6.3-1)
forky: resolved (fixed in 2.6.3-1)
sid: resolved (fixed in 2.6.3-1)
trixie: resolved (fixed in 2.6.3-1)
No detection rules found.
No public exploits indexed.
http://developer.pidgin.im/ticket/10481http://developer.pidgin.im/viewmtn/revision/info/781682333aea0c801d280c3507ee25552a60bfc0http://developer.pidgin.im/wiki/ChangeLoghttp://secunia.com/advisories/37017http://secunia.com/advisories/37072http://www.mandriva.com/security/advisories?name=MDVSA-2010:085http://www.pidgin.im/news/security/?id=41http://www.securityfocus.com/bid/36719http://www.vupen.com/english/advisories/2009/2949http://www.vupen.com/english/advisories/2009/2951http://www.vupen.com/english/advisories/2010/1020https://exchange.xforce.ibmcloud.com/vulnerabilities/53807https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A18388https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9414http://developer.pidgin.im/ticket/10481http://developer.pidgin.im/viewmtn/revision/info/781682333aea0c801d280c3507ee25552a60bfc0http://developer.pidgin.im/wiki/ChangeLoghttp://secunia.com/advisories/37017http://secunia.com/advisories/37072http://www.mandriva.com/security/advisories?name=MDVSA-2010:085http://www.pidgin.im/news/security/?id=41http://www.securityfocus.com/bid/36719http://www.vupen.com/english/advisories/2009/2949http://www.vupen.com/english/advisories/2009/2951http://www.vupen.com/english/advisories/2010/1020https://exchange.xforce.ibmcloud.com/vulnerabilities/53807https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A18388https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9414
2009-10-20
Published