The silchttpserverparse function in lib/silchttp/silchttpserver.c in the internal HTTP server in silcd in Secure Internet Live Conferencing (SILC) Toolkit before 1.1.9 allows remote attackers to overwrite a stack location and possibly execute arbitrary code via a crafted Content-Length header, related to incorrect use of a %lu format string.

The silcasn1encoder function in lib/silcasn1/silcasn1encode.c in Secure Internet Live Conferencing (SILC) Toolkit before 1.1.8 allows remote attackers to overwrite a stack location and possibly execute arbitrary code via a crafted OID value, related to incorrect use of a %lu format string.

Description of problem: pidgin crashes on login to a silc account. I tried setting it up fresh, and from old setup. Both caused the crash.

Version-Release number of selected component (if applicable): pidgin-2.2.2-1.fc8.x8664

How reproducible: Everytime

Steps to Reproduce: 1. Install pidgin 2. Run pidgin 3. Setup silc account Actual results: Crash

Expected results: Runs normally

Additional info: If run from a terminal window it mentions a buffer overflow.

Multiple format string vulnerabilities in lib/silcclient/cliententry.c in Secure Internet Live Conferencing (SILC) Toolkit before 1.1.10, and SILC Client before 1.1.8, allow remote attackers to execute arbitrary code via format string specifiers in a nickname field, related to the (1) silcclientaddclient, (2) silcclientupdateclient, and (3) silcclientnicknameformat functions.

Multiple format string vulnerabilities in lib/silcclient/command.c in Secure Internet Live Conferencing (SILC) Toolkit before 1.1.10, and SILC Client 1.1.8 and earlier, allow remote attackers to execute arbitrary code via format string specifiers in a channel name, related to (1) silcclientcommandtopic, (2) silcclientcommandkick, (3) silcclientcommandleave, and (4) silcclientcommandusers.