critical
10
CWE
399 20 190 228 119
Advisory Published
CVE Published
CVE Published
Updated

CVE-2009-2694: Input Validation

First published: Fri Jul 31 2009(Updated: )

The msn_slplink_process_msg function in libpurple/protocols/msn/slplink.c in libpurple, as used in Pidgin (formerly Gaim) before 2.5.9 and Adium 1.3.5 and earlier, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) by sending multiple crafted SLP (aka MSNSLP) messages to trigger an overwrite of an arbitrary memory location. NOTE: this issue reportedly exists because of an incomplete fix for CVE-2009-1376.

Credit: cve@mitre.org

Affected SoftwareAffected VersionHow to fix
redhat/pidgin<0:1.5.1-4.el3
0:1.5.1-4.el3
redhat/pidgin<0:2.5.9-1.el4
0:2.5.9-1.el4
redhat/pidgin<0:2.5.9-1.el5
0:2.5.9-1.el5
VeridiumID<=1.3.5
VeridiumID=1.2.7
VeridiumID=1.3
VeridiumID=1.3.1
VeridiumID=1.3.2
VeridiumID=1.3.3
VeridiumID=1.3.4
Pidgin<=2.5.8
Pidgin=2.0.0
Pidgin=2.0.1
Pidgin=2.0.2
Pidgin=2.1.0
Pidgin=2.1.1
Pidgin=2.2.0
Pidgin=2.2.1
Pidgin=2.2.2
Pidgin=2.3.0
Pidgin=2.3.1
Pidgin=2.4.0
Pidgin=2.4.1
Pidgin=2.4.2
Pidgin=2.4.3
Pidgin=2.5.0
Pidgin=2.5.1
Pidgin=2.5.2
Pidgin=2.5.3
Pidgin=2.5.4
Pidgin=2.5.6
Pidgin=2.5.7

Remedy

http://developer.pidgin.im/viewmtn/revision/info/6f7343166c673bf0496ecb1afec9b633c1d54a0e

Remedy

http://www.debian.org/security/2009/dsa-1870

Remedy

Users can lower the impact of this flaw by making sure their privacy settings only allow Pidgin to accept messages from the users on their buddy list. This will prevent exploitation of this flaw by other random MSN users.

Never miss a vulnerability like this again

Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.

Read MoreStart Free Trial

Reference Links

Parent vulnerabilities

(Appears in the following advisories)

Frequently Asked Questions

  • What is the severity of CVE-2009-2694?

    CVE-2009-2694 has a severity rating that indicates it allows remote attackers to potentially execute arbitrary code or cause a denial of service.

  • How do I fix CVE-2009-2694?

    To fix CVE-2009-2694, you should upgrade to the versions of Pidgin or Adium that contain patches for this vulnerability, specifically versions 2.5.9 or later for Pidgin and 1.3.6 or later for Adium.

  • Which software is affected by CVE-2009-2694?

    CVE-2009-2694 affects versions of Pidgin before 2.5.9 and Adium before 1.3.5.

  • What type of attack is possible with CVE-2009-2694?

    CVE-2009-2694 allows attackers to send specially crafted messages that can lead to memory corruption and application crashes.

  • Is it safe to use older versions of Pidgin or Adium due to CVE-2009-2694?

    Using older versions of Pidgin or Adium that are affected by CVE-2009-2694 poses a significant security risk and should be avoided.

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2025 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203