Description
Buffer overflow in the XMPP SOCKS5 bytestream server in Pidgin (formerly Gaim) before 2.5.6 allows remote authenticated users to execute arbitrary code via vectors involving an outbound XMPP file transfer. NOTE: some of these details are obtained from third party information.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | pidgin | 2.5.6-1 | — |
| Debian 13 | pidgin | 2.5.6-1 | — |
| Debian 12 | pidgin | 2.5.6-1 | — |
| Debian 5.0 | pidgin | 2.4.3-4lenny2 | DSA-1805-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 5 | finch +8 | 2.5.5-3.el5 | RHSA-2009:1060 |
| RHEL 4 | finch +8 | 2.5.5-2.el4 | RHSA-2009:1060 |
| RHEL 3 | pidgin | 1.5.1-3.el3 | RHSA-2009:1059 |
Advisories 3
- RHSA-2009:1060 Red Hat Security Advisory: pidgin security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2009:1059 Red Hat Security Advisory: pidgin security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- DSA-1805-1 pidgin - several vulnerabilities Debian Security (DSA / DLA) · Mar 9, 2026
References
- FEDORA-2009-5597 vendor-advisory
- RHSA-2009:1060 vendor-advisory
- USN-781-2 vendor-advisory
- RHSA-2009:1059 vendor-advisory
- GLSA-200905-07 vendor-advisory
- oval:org.mitre.oval:def:9005 vdb-entry signature
- 35067 vdb-entry
- FEDORA-2009-5583 vendor-advisory
- 35329 third-party-advisory
- USN-781-1 vendor-advisory
- oval:org.mitre.oval:def:17722 vdb-entry signature
- DSA-1805 vendor-advisory
- MDVSA-2009:140 vendor-advisory
- 35294 third-party-advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=500488
- 35188 third-party-advisory
- pidgin-xmppsocks5-bo(50682) vdb-entry
- 35194 third-party-advisory
- FEDORA-2009-5552 vendor-advisory
- 35202 third-party-advisory
- http://www.pidgin.im/news/security/?id=29
- 35215 third-party-advisory
- ADV-2009-1396 vdb-entry
- 35330 third-party-advisory
- MDVSA-2009:173 vendor-advisory