CVE-2009-3615 — Pidgin vulnerability

CWE-3997 documents7 sources
Severity
5.0MEDIUMNVD
EPSS
8.4%
top 7.65%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
PidginDebian PidginAdium
Timeline
PublishedOct 20
Latest updateMay 2

Description

The OSCAR protocol plugin in libpurple in Pidgin before 2.6.3 and Adium before 1.3.7 allows remote attackers to cause a denial of service (application crash) via crafted contact-list data for (1) ICQ and possibly (2) AIM, as demonstrated by the SIM IM client.

CVSS vector

AV:N/AC:L/C:N/I:N/A:PExploitability: 10.0 | Impact: 2.9

Affected Packages4 packages

▶debiandebian/pidgin< pidgin 2.6.3-1 (bookworm)
▶Debianpidgin/pidgin< 2.6.3-1+3
▶NVDadium/adium1.3.6+18
▶NVDpidgin/pidgin2.6.2+26

Patches

Patch: developer.pidgin.im ↗Patch: developer.pidgin.im ↗

🔴Vulnerability Details

2
GHSA
GHSA-vj8h-wj7f-5mcf: The OSCAR protocol plugin in libpurple in Pidgin before 2↗2022-05-02
▶
OSV
CVE-2009-3615: The OSCAR protocol plugin in libpurple in Pidgin before 2↗2009-10-20
▶

📋Vendor Advisories

3
Ubuntu
Pidgin vulnerabilities↗2010-01-18
▶
Red Hat
Pidgin: Invalid pointer dereference (crash) after receiving contacts from SIM IM client↗2009-10-10
▶
Debian
CVE-2009-3615: pidgin - The OSCAR protocol plugin in libpurple in Pidgin before 2.6.3 and Adium before 1...↗2009
▶

💬Community

1
Bugzilla
CVE-2009-3615 Pidgin: Invalid pointer dereference (crash) after receiving contacts from SIM IM client↗2009-10-16
▶