CVE-2009-3615: Medium severity veridiumid vulnerability
Published Oct 20, 2009
·Updated
The OSCAR protocol plugin in libpurple in Pidgin before 2.6.3 and Adium before 1.3.7 allows remote attackers to cause a denial of service (application crash) via crafted contact-list data for (1) ICQ and possibly (2) AIM, as demonstrated by the SIM IM client.
Affected Software
46 affected components
Adium Adium<=1.3.6
Adium Adium=1.0
Adium Adium=1.0.1
Adium Adium=1.0.2
Adium Adium=1.0.3
Adium Adium=1.0.4
Adium Adium=1.0.5
Adium Adium=1.1
Adium Adium=1.1.1
Adium Adium=1.1.2
Adium Adium=1.1.3
Adium Adium=1.1.4
Adium Adium=1.2.7
Adium Adium=1.3
Adium Adium=1.3.1
Adium Adium=1.3.2
Adium Adium=1.3.3
Adium Adium=1.3.4
Adium Adium=1.3.5
Pidgin Pidgin<=2.6.2
Pidgin Pidgin=2.0.0
Pidgin Pidgin=2.0.1
Pidgin Pidgin=2.0.2
Pidgin Pidgin=2.1.0
Pidgin Pidgin=2.1.1
Pidgin Pidgin=2.2.0
Pidgin Pidgin=2.2.1
Pidgin Pidgin=2.2.2
Pidgin Pidgin=2.3.0
Pidgin Pidgin=2.3.1
Pidgin Pidgin=2.4.0
Pidgin Pidgin=2.4.1
Pidgin Pidgin=2.4.2
Pidgin Pidgin=2.4.3
Pidgin Pidgin=2.5.0
Pidgin Pidgin=2.5.1
Pidgin Pidgin=2.5.2
Pidgin Pidgin=2.5.3
Pidgin Pidgin=2.5.4
Pidgin Pidgin=2.5.5
Pidgin Pidgin=2.5.6
Pidgin Pidgin=2.5.7
Pidgin Pidgin=2.5.8
Pidgin Pidgin=2.5.9
Pidgin Pidgin=2.6.0
Pidgin Pidgin=2.6.1
Remediation
Patch Available
Event History
Oct 20, 2009
CVE Published
via MITRE·05:00 PM
Data Sourced
via MITRE·05:00 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2009-3615?
CVE-2009-3615 has a medium severity level as it can lead to denial of service due to application crashes.
2
How do I fix CVE-2009-3615?
To fix CVE-2009-3615, upgrade Pidgin to version 2.6.3 or later, or Adium to version 1.3.7 or later.
3
Which versions of Pidgin are affected by CVE-2009-3615?
Affected versions of Pidgin include 2.5.9 and earlier up to 2.6.2.
4
Which versions of Adium are affected by CVE-2009-3615?
Affected versions of Adium include 1.3.6 and earlier.
5
What type of attack can exploit CVE-2009-3615?
CVE-2009-3615 can be exploited by sending crafted contact-list data to cause the application to crash.