Description
Multiple integer overflows in the msn_slplink_process_msg functions in the MSN protocol handler in (1) libpurple/protocols/msn/slplink.c and (2) libpurple/protocols/msnp9/slplink.c in Pidgin before 2.4.3 and Adium before 1.3 allow remote attackers to execute arbitrary code via a malformed SLP message with a crafted offset value, a different vulnerability than CVE-2008-2955.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | pidgin | 2.4.3-1 | — |
| Debian 13 | pidgin | 2.4.3-1 | — |
| Debian 12 | pidgin | 2.4.3-1 | — |
| Debian 5.0 | pidgin | 2.4.3-4lenny2 | DSA-1805-1 |
| Debian 4.0 | gaim | 1:2.0.0+beta5-10etch1 | DSA-1610-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 5 | finch +8 | 2.3.1-2.el5_2 | RHSA-2008:0584 |
| RHEL 4 | pidgin | 1.5.1-2.el4 | RHSA-2008:0584 |
| RHEL 3 | pidgin | 1.5.1-2.el3 | RHSA-2008:0584 |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Rhel Productivity 5 | finch +8 | 2.3.1-2.el5_2 | RHSA-2008:0584 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | pidgin | 2.14.7-1.1 | openSUSE-SU-2024:11172-1 |
Advisories 4
- RHSA-2008:0584 Red Hat Security Advisory: pidgin security and bug fix update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- DSA-1805-1 pidgin - several vulnerabilities Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-1610-1 gaim - execution of arbitrary code Debian Security (DSA / DLA) · Mar 9, 2026
- openSUSE-SU-2024:11172-1 finch-2.14.7-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
References
- USN-675-2 vendor-advisory
- [oss-security] 20080703 Re: Re: CVE Request (pidgin) mailing-list
- RHSA-2008:0584 vendor-advisory
- http://developer.pidgin.im/viewmtn/revision/diff/6eb1949a96fa80a4c744fc749c2562abc4cc9ed6/with/c3831c9181f4f61b747321240086ee79e4a08fd8/libpurple/protocols/msnp9/slplink.c
- 32861 third-party-advisory
- 1020451 vdb-entry
- 30971 third-party-advisory
- oval:org.mitre.oval:def:11695 vdb-entry signature
- http://developer.pidgin.im/viewmtn/revision/diff/6eb1949a96fa80a4c744fc749c2562abc4cc9ed6/with/c3831c9181f4f61b747321240086ee79e4a08fd8/libpurple/protocols/msn/slplink.c
- 29956 vdb-entry
- MDVSA-2008:143 vendor-advisory
- oval:org.mitre.oval:def:17972 vdb-entry signature
- http://wiki.rpath.com/wiki/Advisories:rPSA-2008-0246
- https://issues.rpath.com/browse/RPL-2647
- MDVSA-2009:127 vendor-advisory
- [oss-security] 20080704 Re: Re: CVE Request (pidgin) mailing-list
- 31105 third-party-advisory
- http://www.pidgin.im/news/security/?id=25
- USN-675-1 vendor-advisory
- http://www.zerodayinitiative.com/advisories/ZDI-08-054
- 31642 third-party-advisory
- 32859 third-party-advisory
- 31387 third-party-advisory
- DSA-1610 vendor-advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=453764
- 31016 third-party-advisory
- 20080828 ZDI-08-054: Multiple Vendor libpurple MSN Protocol SLP Message Heap Overflow Vulnerability mailing-list
- adium-msnprotocol-code-execution(44774) vdb-entry
- ADV-2008-2032 vdb-entry
- 20080625 Pidgin 2.4.1 Vulnerability mailing-list
- 20080806 rPSA-2008-0246-1 gaim mailing-list