oss-sec mailing list archives
Re: CVE request - pidgin MSN arbitrary file upload
From: "Steven M. Christey" <coley () linus mitre org>
Date: Sat, 9 Jan 2010 13:08:49 -0500 (EST)
On Thu, 7 Jan 2010, Nico Golde wrote:
While everyone is talking about the file inclusion vulnerability which is really important, has anyone investigated the SLP memory corruption issue yet? Page 24: http://events.ccc.de/congress/2009/Fahrplan/attachments/1483_26c3_ipv4_fuckups.pdf
Use CVE-2010-0277 for the memory corruption. - Steve ====================================================== Name: CVE-2010-0277 Status: Candidate URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0277 Reference: MLIST:[oss-security] 20100107 Re: CVE request - pidgin MSN arbitrary file upload Reference: URL:http://www.openwall.com/lists/oss-security/2010/01/07/2 Reference: MISC:http://events.ccc.de/congress/2009/Fahrplan/events/3596.en.html slp.c in the MSN protocol plugin in libpurple in Pidgin 2.6.4 and Adium 1.3.8 allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via unknown vectors, a different issue than CVE-2010-0013.
Current thread:
- CVE request - pidgin MSN arbitrary file upload Paul Aurich (Jan 02)
- Re: CVE request - pidgin MSN arbitrary file upload Josh Bressers (Jan 07)
- Re: CVE request - pidgin MSN arbitrary file upload Nico Golde (Jan 07)
- Re: CVE request - pidgin MSN arbitrary file upload Steven M. Christey (Jan 09)
- Re: CVE request - pidgin MSN arbitrary file upload Nico Golde (Jan 07)
- Re: CVE request - pidgin MSN arbitrary file upload Josh Bressers (Jan 07)