CVE-2010-4528: Input Validation
A NULL pointer dereference flaw was found in the Pidgin MSN DirectConnect protocol implementation, by processing certain P2P messages. A remote, authenticated user could use this flaw to cause denial of service (Pidgin crash).
Acknowledgements:
Red Hat would like to thank the Pidgin project for reporting this issue. Upstream acknowledges Stu Tomlinson as the original reporter.
Other sources
directconn.c in the MSN protocol plugin in libpurple 2.7.6 through 2.7.8 in Pidgin before 2.7.9 allows remote authenticated users to cause a denial of service (NULL pointer dereference and application crash) via a short p2pv2 packet in a DirectConnect (aka direct connection) session.
Affected Software
Remediation
Patch Available
Patch Available
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2010-4528?
CVE-2010-4528 has a medium severity rating due to the potential for denial of service via a crash of the Pidgin application.
How do I fix CVE-2010-4528?
To fix CVE-2010-4528, it is recommended to upgrade to Pidgin version 2.7.8 or later.
What software is affected by CVE-2010-4528?
CVE-2010-4528 affects Pidgin versions up to and including 2.7.7 and all versions of libpurple up to 2.7.8.
What happens if I exploit CVE-2010-4528?
Exploiting CVE-2010-4528 can cause the Pidgin application to crash, resulting in a denial of service for users.
Is remote authentication required to exploit CVE-2010-4528?
Yes, a remote, authenticated user is needed to exploit CVE-2010-4528 and trigger the vulnerability.