CVE-2010-1624: Input Validation
Pierre Noguès found a NULL pointer dereference in the Pidgin MSN SLP protocol implementation, by processing custom emoticon messages. A remote, authenticated user could use this deficiency to cause a denial of service (Pidgin crash).
Acknowledgements:
Red Hat would like to thank the Pidgin project for reporting this issue. Upstream acknowledges Pierre Noguès of Meta Security as the original reporter.
Other sources
The msnemoticonmsg function in slp.c in the MSN protocol plugin in libpurple in Pidgin before 2.7.0 allows remote authenticated users to cause a denial of service (NULL pointer dereference and application crash) via a custom emoticon in a malformed SLP message.
— Red Hat
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2010-1624?
The severity of CVE-2010-1624 is categorized as a denial of service vulnerability affecting the Pidgin software.
How do I fix CVE-2010-1624?
To fix CVE-2010-1624, upgrade to a patched version of Pidgin, specifically version 2.6.6-5.el4_8 or 2.6.6-5.el5_5.
Who can exploit CVE-2010-1624?
CVE-2010-1624 can be exploited by a remote, authenticated user through specially crafted custom emoticon messages.
What software is affected by CVE-2010-1624?
CVE-2010-1624 affects Pidgin versions prior to 2.6.6-5.el4_8 and 2.6.6-5.el5_5, as well as certain Ubuntu Linux versions.
What is the impact of CVE-2010-1624?
The impact of CVE-2010-1624 is that it can cause Pidgin to crash, leading to a denial of service for users.