CVE-2014-3775: Input Validation
It was reported that the libgadu 1.12.0-rc3 release fixes a memory corruption issue, triggered by a crafted response from a file relay server:
http://www.openwall.com/lists/oss-security/2014/05/15/8
A malicious file relay server could possibly use this flaw to execute arbitrary code in an application that uses libgadu.
Other sources
libgadu before 1.11.4 and 1.12.0 before 1.12.0-rc3, as used in Pidgin and other products, allows remote Gadu-Gadu file relay servers to cause a denial of service (memory overwrite) or possibly execute arbitrary code via a crafted message.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What impact does CVE-2014-3775 have on affected systems?
CVE-2014-3775 can lead to memory corruption due to crafted responses from malicious file relay servers.
How can I mitigate CVE-2014-3775?
To mitigate CVE-2014-3775, you should upgrade to libgadu version 1.12.0 or later.
What versions are affected by CVE-2014-3775?
CVE-2014-3775 affects libgadu versions prior to 1.12.0, including versions 1.11.4 and earlier release candidates.
Is CVE-2014-3775 a critical vulnerability?
The severity of CVE-2014-3775 is considered high due to the potential for remote exploitation.
What is the exploit method for CVE-2014-3775?
CVE-2014-3775 is exploited by sending specially crafted responses from a malicious file relay server to the target application.