CVE-2009-3085: Medium severity libpurple vulnerability
Published Sep 8, 2009
·Updated
The XMPP protocol plugin in libpurple in Pidgin before 2.6.2 does not properly handle an error IQ stanza during an attempted fetch of a custom smiley, which allows remote attackers to cause a denial of service (application crash) via XHTML-IM content with cid: images.
Affected Software
37 affected components
Pidgin libpurple
Pidgin Pidgin<=2.6.1
Pidgin Pidgin=2.0.0
Pidgin Pidgin=2.0.1
Pidgin Pidgin=2.0.2
Pidgin Pidgin=2.0.2
Pidgin Pidgin=2.1.0
Pidgin Pidgin=2.1.1
Pidgin Pidgin=2.2.0
Pidgin Pidgin=2.2.1
Pidgin Pidgin=2.2.2
Pidgin Pidgin=2.3.0
Pidgin Pidgin=2.3.1
Pidgin Pidgin=2.4.0
Pidgin Pidgin=2.4.0-32_bit
Pidgin Pidgin=2.4.1
Pidgin Pidgin=2.4.1-32_bit
Pidgin Pidgin=2.4.2
Pidgin Pidgin=2.4.2-32_bit
Pidgin Pidgin=2.4.3
Pidgin Pidgin=2.4.3-32_bit
Pidgin Pidgin=2.5.0
Pidgin Pidgin=2.5.0-32_bit
Pidgin Pidgin=2.5.1
Pidgin Pidgin=2.5.2
Pidgin Pidgin=2.5.2-32_bit
Pidgin Pidgin=2.5.3
Pidgin Pidgin=2.5.3-32_bit
Pidgin Pidgin=2.5.4
Pidgin Pidgin=2.5.4-32_bit
Pidgin Pidgin=2.5.5
Pidgin Pidgin=2.5.5-32_bit
Pidgin Pidgin=2.5.6
Pidgin Pidgin=2.5.7
Pidgin Pidgin=2.5.8
Pidgin Pidgin=2.5.9
Pidgin Pidgin=2.6.0
Remediation
Patch Available
Event History
Sep 8, 2009
CVE Published
via MITRE·06:00 PM
Data Sourced
via MITRE·06:00 PM
Description
Data Sourced
06:30 PM
DescriptionWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2009-3085?
CVE-2009-3085 has been classified as a denial of service vulnerability that can cause application crashes.
2
How do I fix CVE-2009-3085?
To mitigate CVE-2009-3085, upgrade to Pidgin version 2.6.2 or later immediately.
3
Which versions of Pidgin are affected by CVE-2009-3085?
CVE-2009-3085 affects Pidgin versions prior to 2.6.2.
4
What types of attacks can exploit CVE-2009-3085?
CVE-2009-3085 can be exploited via malicious XHTML-IM content containing specific cid: images.
5
What is the potential impact of CVE-2009-3085 on users?
The potential impact of CVE-2009-3085 on users includes application crashes leading to denial of service.