CVE-2008-2927: Integer Overflow
An integer overflow in Pidgin's MSN protocol handler could allow malformed SLP message to cause an integer overflow, which could result in arbitrary code execution.
This flaw is only exploitable by individuals who can message a user, which is controlled by the Pidgin privacy setting. The default setting is to only allow messages from users in the buddy list.
Other sources
Multiple integer overflows in the msnslplinkprocessmsg functions in the MSN protocol handler in (1) libpurple/protocols/msn/slplink.c and (2) libpurple/protocols/msnp9/slplink.c in Pidgin before 2.4.3 and Adium before 1.3 allow remote attackers to execute arbitrary code via a malformed SLP message with a crafted offset value, a different vulnerability than CVE-2008-2955.
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2008-2927?
CVE-2008-2927 has a high severity rating due to potential remote code execution risks.
How do I fix CVE-2008-2927?
To fix CVE-2008-2927, upgrade to Pidgin version 2.4.3 or later and Adium version 1.3 or later.
Which versions are affected by CVE-2008-2927?
CVE-2008-2927 affects Pidgin versions prior to 2.4.3 and Adium versions prior to 1.3.
What kind of attack can exploit CVE-2008-2927?
CVE-2008-2927 can be exploited through malformed SLP messages sent by remote attackers.
Is CVE-2008-2927 specific to certain operating systems?
CVE-2008-2927 affects Pidgin and Adium regardless of the operating system they are installed on.