CVE-2009-3083: Buffer Overflow
The msnslpsiprecv function in libpurple/protocols/msn/slp.c in the MSN protocol plugin in libpurple in Pidgin before 2.6.2 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via an SLP invite message that lacks certain required fields, as demonstrated by a malformed message from a KMess client.
Affected Software
Remediation
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2009-3083?
CVE-2009-3083 is classified as a denial of service vulnerability due to a NULL pointer dereference that can crash the application.
How do I fix CVE-2009-3083?
To fix CVE-2009-3083, upgrade to Pidgin version 2.6.2 or later.
Which versions are affected by CVE-2009-3083?
CVE-2009-3083 affects all versions of Pidgin prior to 2.6.2.
What causes the vulnerability CVE-2009-3083?
CVE-2009-3083 is caused by the msn_slp_sip_recv function failing to properly handle malformed SLP invite messages.
Can CVE-2009-3083 be exploited remotely?
Yes, CVE-2009-3083 can be exploited remotely by sending crafted SLP invite messages.