Vulnerability Details : CVE-2009-1374
Buffer overflow in the decrypt_out function in Pidgin (formerly Gaim) before 2.5.6 allows remote attackers to cause a denial of service (application crash) via a QQ packet.
Vulnerability category: OverflowDenial of service
Products affected by CVE-2009-1374
- cpe:2.3:a:pidgin:pidgin:*:*:*:*:*:*:*:*
- cpe:2.3:a:pidgin:pidgin:2.0.2:*:linux:*:*:*:*:*
- cpe:2.3:a:pidgin:pidgin:2.2.0:*:*:*:*:*:*:*
- cpe:2.3:a:pidgin:pidgin:2.2.1:*:*:*:*:*:*:*
- cpe:2.3:a:pidgin:pidgin:2.1.0:*:*:*:*:*:*:*
- cpe:2.3:a:pidgin:pidgin:2.0.0:*:*:*:*:*:*:*
- cpe:2.3:a:pidgin:pidgin:2.3.0:*:*:*:*:*:*:*
- cpe:2.3:a:pidgin:pidgin:2.3.1:*:*:*:*:*:*:*
- cpe:2.3:a:pidgin:pidgin:2.0.1:*:*:*:*:*:*:*
- cpe:2.3:a:pidgin:pidgin:2.0.2:*:*:*:*:*:*:*
- cpe:2.3:a:pidgin:pidgin:2.4.0:*:*:*:*:*:*:*
- cpe:2.3:a:pidgin:pidgin:2.4.1:*:*:*:*:*:*:*
- cpe:2.3:a:pidgin:pidgin:2.2.2:*:*:*:*:*:*:*
- cpe:2.3:a:pidgin:pidgin:2.1.1:*:*:*:*:*:*:*
- cpe:2.3:a:pidgin:pidgin:2.4.3:*:*:*:*:*:*:*
- cpe:2.3:a:pidgin:pidgin:2.5.1:*:*:*:*:*:*:*
- cpe:2.3:a:pidgin:pidgin:2.5.0:*:*:*:*:*:*:*
- cpe:2.3:a:pidgin:pidgin:2.4.2:*:*:*:*:*:*:*
- cpe:2.3:a:pidgin:pidgin:2.5.3:*:*:*:*:*:*:*
- cpe:2.3:a:pidgin:pidgin:2.5.2:*:*:*:*:*:*:*
- cpe:2.3:a:pidgin:pidgin:2.5.4:*:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2009-1374
12.93%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 95 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2009-1374
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
5.0
|
MEDIUM | AV:N/AC:L/Au:N/C:N/I:N/A:P |
10.0
|
2.9
|
NIST |
CWE ids for CVE-2009-1374
-
The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.Assigned by: nvd@nist.gov (Primary)
References for CVE-2009-1374
-
http://www.mandriva.com/security/advisories?name=MDVSA-2009:173
Mandriva
-
https://www.redhat.com/archives/fedora-package-announce/2009-June/msg00075.html
[SECURITY] Fedora 10 Update: pidgin-2.5.6-1.fc10
-
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11654
404 Not Found
-
http://www.securityfocus.com/bid/35067
Patch
-
http://www.gentoo.org/security/en/glsa/glsa-200905-07.xml
Pidgin: Multiple vulnerabilities (GLSA 200905-07) — Gentoo security
-
http://www.vupen.com/english/advisories/2009/1396
Site en construction
-
https://www.redhat.com/archives/fedora-package-announce/2009-June/msg00051.html
[SECURITY] Fedora 11 Update: pidgin-2.5.6-1.fc11
-
http://www.redhat.com/support/errata/RHSA-2009-1060.html
Support
-
https://bugzilla.redhat.com/show_bug.cgi?id=500490
500490 – (CVE-2009-1374) CVE-2009-1374 pidgin DoS when decrypting qq packets
-
https://www.redhat.com/archives/fedora-package-announce/2009-June/msg00033.html
[SECURITY] Fedora 9 Update: pidgin-2.5.6-1.fc9
-
http://www.ubuntu.com/usn/USN-781-1
USN-781-1: Pidgin vulnerabilities | Ubuntu security notices | Ubuntu
-
http://www.pidgin.im/news/security/?id=30
404 Page not foundPatch;Vendor Advisory
-
https://exchange.xforce.ibmcloud.com/vulnerabilities/50684
Pidgin decrypt_out() buffer overflow CVE-2009-1374 Vulnerability Report
-
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A18201
404 Not Found
Jump to