Description
Multiple buffer overflows in Gaim 0.75 and earlier, and Ultramagnetic before 0.81, allow remote attackers to cause a denial of service and possibly execute arbitrary code via (1) cookies in a Yahoo web connection, (2) a long name parameter in the Yahoo login web page, (3) a long value parameter in the Yahoo login page, (4) a YMSG packet, (5) the URL parser, and (6) HTTP proxy connect.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 3.0 | gaim | 0.58-2.4 | DSA-434 |
Advisories 1
- DSA-434 gaim - several vulnerabilities Debian Security (DSA / DLA) · Mar 9, 2026
References
- 9489 vdb-entry
- DSA-434 vendor-advisory
- RHSA-2004:032 vendor-advisory
- SuSE-SA:2004:004 vendor-advisory
- 3732 vdb-entry
- SSA:2004-026 vendor-advisory
- oval:org.mitre.oval:def:818 vdb-entry signature
- VU#871838 third-party-advisory
- VU#444158 third-party-advisory
- 20040126 Advisory 01/2004: 12 x Gaim remote overflows mailing-list
- VU#297198 third-party-advisory
- gaim-login-value-bo(14941) vdb-entry
- oval:org.mitre.oval:def:10222 vdb-entry signature
- http://ultramagnetic.sourceforge.net/advisories/001.html
- GLSA-200401-04 vendor-advisory
- 1008850 vdb-entry
- 20040127 Ultramagnetic Advisory #001: Multiple vulnerabilities in Gaim code mailing-list
- http://security.e-matters.de/advisories/012004.html
- RHSA-2004:033 vendor-advisory
- MDKSA-2004:006 vendor-advisory
- gaim-yahoowebpending-cookie-bo(14939) vdb-entry
- gaim-http-proxy-bo(14947) vdb-entry
- gaim-login-name-bo(14940) vdb-entry
- 20040126 Advisory 01/2004: 12 x Gaim remote overflows mailing-list
- VU#527142 third-party-advisory
- gaim-urlparser-bo(14945) vdb-entry
- VU#371382 third-party-advisory
- gaim-yahoopacketread-keyname-bo(14943) vdb-entry
- CLA-2004:813 vendor-advisory
- 3731 vdb-entry
- VU#503030 third-party-advisory
- RHSA-2004:045 vendor-advisory