CVE-2009-3083

Description

The msn_slp_sip_recv function in libpurple/protocols/msn/slp.c in the MSN protocol plugin in libpurple in Pidgin before 2.6.2 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via an SLP invite message that lacks certain required fields, as demonstrated by a malformed message from a KMess client.

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗

Release	Package	Fixed in	Advisory
Debian 14	pidgin	2.6.2-1	—
Debian 13	pidgin	2.6.2-1	—
Debian 12	pidgin	2.6.2-1	—
Debian 5.0	pidgin	2.4.3-4lenny6	DSA-2038-1

Red Hat

Security tracker ↗

Release	Package	Fixed in	Advisory
RHEL 5	finch +8	2.6.2-2.el5	RHSA-2009:1453
RHEL 4	finch +8	2.6.2-2.el4	RHSA-2009:1453
RHEL 3	pidgin	1.5.1-6.el3	RHSA-2009:1535

Show 1 more (older releases, extended support, other products)

Release	Package	Fixed in	Advisory
Red Hat Rhel Productivity 5	finch +8	2.6.2-2.el5	RHSA-2009:1453

Advisories 3

RHSA-2009:1453 Red Hat Security Advisory: pidgin security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
RHSA-2009:1535 Red Hat Security Advisory: pidgin security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
DSA-2038-1 pidgin - denial of service Debian Security (DSA / DLA) · Mar 9, 2026

References

http://developer.pidgin.im/ticket/10159
36601 third-party-advisory
http://www.pidgin.im/news/security/index.php?id=39
http://developer.pidgin.im/viewmtn/revision/diff/6d3fc30a0a0a379281efc5a6872a9c1d7c24c650/with/b4a95ea62b81a06ffc1993912471c511b786efdd/libpurple/protocols/msn/slp.c
oval:org.mitre.oval:def:11852 vdb-entry signature
36277 vdb-entry
http://developer.pidgin.im/viewmtn/revision/info/b4a95ea62b81a06ffc1993912471c511b786efdd
oval:org.mitre.oval:def:6322 vdb-entry signature