Description
Multiple buffer overflows in Gaim 0.75 allow remote attackers to cause a denial of service and possibly execute arbitrary code via (1) octal encoding in yahoo_decode that causes a null byte to be written beyond the buffer, (2) octal encoding in yahoo_decode that causes a pointer to reference memory beyond the terminating null byte, (3) a quoted printable string to the gaim_quotedp_decode MIME decoder that causes a null byte to be written beyond the buffer, and (4) quoted printable encoding in gaim_quotedp_decode that causes a pointer to reference memory beyond the terminating null byte.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 3.0 | gaim | 0.58-2.4 | DSA-434 |
Advisories 1
- DSA-434 gaim - several vulnerabilities Debian Security (DSA / DLA) · Mar 9, 2026
References
- gaim-mime-decoder-oob(14944) vdb-entry
- VU#226974 third-party-advisory
- DSA-434 vendor-advisory
- gaim-mime-decoder-bo(14942) vdb-entry
- SuSE-SA:2004:004 vendor-advisory
- SSA:2004-026 vendor-advisory
- gaim-yahoodecode-offbyone-bo(14935) vdb-entry
- 20040126 Advisory 01/2004: 12 x Gaim remote overflows mailing-list
- GLSA-200401-04 vendor-advisory
- 1008850 vdb-entry
- http://security.e-matters.de/advisories/012004.html
- 3736 vdb-entry
- 20040126 Advisory 01/2004: 12 x Gaim remote overflows mailing-list
- VU#655974 third-party-advisory
- VU#190366 third-party-advisory
- CLA-2004:813 vendor-advisory
- VU#404470 third-party-advisory
- gaim-sscanf-oob(14938) vdb-entry