CVE-2008-2927

Publication date 7 July 2008

Last updated 24 July 2024

Ubuntu priority

Description

Multiple integer overflows in the msn_slplink_process_msg functions in the MSN protocol handler in (1) libpurple/protocols/msn/slplink.c and (2) libpurple/protocols/msnp9/slplink.c in Pidgin before 2.4.3 and Adium before 1.3 allow remote attackers to execute arbitrary code via a malformed SLP message with a crafted offset value, a different vulnerability than CVE-2008-2955.

Status

Show unmaintained releases

Package	Ubuntu Release	Status
gaim	8.10 intrepid	Not in release
	8.04 LTS hardy	Not in release
	7.10 gutsy	Not in release
	7.04 feisty	Ignored end of life, was needed
	6.06 LTS dapper	Fixed 1:1.5.0+1.5.1cvs20051015-1ubuntu10.1
pidgin	8.10 intrepid	Not affected
	8.04 LTS hardy	Fixed 1:2.4.1-1ubuntu2.2
	7.10 gutsy	Fixed 1:2.2.1-1ubuntu4.3
	7.04 feisty	Not in release
	6.06 LTS dapper	Not in release

Patch details

For informational purposes only. We recommend not to cherry-pick updates. How can I get the fixes?

Package	Patch details
pidgin	Debdiff: https://bugs.launchpad.net/bugs/245770 Upstream: http://developer.pidgin.im/viewmtn/revision/diff/6eb1949a96fa80a4c744fc749c2562abc4cc9ed6/with/c3831c9181f4f61b747321240086ee79e4a08fd8/libpurple/protocols/msn/slplink.c Upstream: http://developer.pidgin.im/viewmtn/revision/diff/6eb1949a96fa80a4c744fc749c2562abc4cc9ed6/with/c3831c9181f4f61b747321240086ee79e4a08fd8/libpurple/protocols/msnp9/slplink.c Upstream: http://patch-tracking.debian.net/patch/series/view/gaim/1:2.0.0+beta5-10etch1/20_CVE-2008-2927.patch Vendor: https://bugzilla.redhat.com/attachment.cgi?id=310788

Package

Patch details

pidgin

References

Related Ubuntu Security Notices (USN)

USN-675-1
Pidgin vulnerabilities
24 November 2008

USN-675-2
Gaim vulnerability
24 November 2008

Other references

https://www.cve.org/CVERecord?id=CVE-2008-2927