Description
libpurple in Pidgin before 2.2.1 does not properly handle MSN nudge messages from users who are not on the receiver's buddy list, which allows remote attackers to cause a denial of service (crash) via a nudge message that triggers an access of "an invalid memory location."
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | pidgin | 2.2.1-1 | — |
| Debian 13 | pidgin | 2.2.1-1 | — |
| Debian 12 | pidgin | 2.2.1-1 | — |
References
- pidgin-msn-nudge-dos(36884) vdb-entry
- 27088 third-party-advisory
- 20071003 FLEA-2007-0057-1 pidgin mailing-list
- ADV-2007-3321 vdb-entry
- http://www.pidgin.im/news/security/?id=23
- 25872 vdb-entry
- FEDORA-2007-2368 vendor-advisory
- oval:org.mitre.oval:def:18261 vdb-entry signature
- 27010 third-party-advisory