Pidgin 'X-Status' Message Denial of Service Vulnerability

Bugtraq ID:	41881
Class:	Failure to Handle Exceptional Conditions
CVE:	CVE-2010-2528
Remote:	Yes
Local:	No
Published:	Jul 21 2010 12:00AM
Updated:	Apr 16 2015 05:49PM
Credit:	Mark Doliner
Vulnerable:	Sun Solaris 10_x86 Sun Solaris 10_sparc Slackware Linux x86_64 -current Slackware Linux 13.1 x86_64 Slackware Linux 13.1 Slackware Linux 13.0 x86_64 Slackware Linux 13.0 Slackware Linux 12.2 Slackware Linux 12.1 Slackware Linux 12.0 Slackware Linux -current Pidgin Pidgin 2.7.1 Pidgin Pidgin 2.7 Pidgin Pidgin 2.6.6 Pidgin Pidgin 2.6.5 Pidgin Pidgin 2.6.4 Pidgin Pidgin 2.6.3 Pidgin Pidgin 2.6.1 Pidgin Pidgin 2.6 Pardus Linux 2009 0 Mandriva Linux Mandrake 2010.1 x86_64 Mandriva Linux Mandrake 2010.1 Mandriva Linux Mandrake 2010.0 x86_64 Mandriva Linux Mandrake 2010.0 Mandriva Linux Mandrake 2009.0 x86_64 Mandriva Linux Mandrake 2009.0 Mandriva Linux Mandrake 2008.0 x86_64 Mandriva Linux Mandrake 2008.0
Not Vulnerable:	Pidgin Pidgin 2.7.2

Pidgin 'X-Status' Message Denial of Service Vulnerability

Pidgin is prone to a denial-of-service vulnerability because it fails to properly validate user-supplied input.

Successful exploits will cause the affected application to crash, effectively denying service to legitimate users.

Pidgin versions prior to 2.7.2 are vulnerable.

Pidgin 'X-Status' Message Denial of Service Vulnerability

Currently we are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected]

Pidgin 'X-Status' Message Denial of Service Vulnerability

Solution:
Updates are available. Please see the references for more information.


Slackware Linux 13.0 x86_64

• Slackware pidgin-2.7.3-x86_64-1_slack13.0.txz
  ftp://ftp.slackware.com/pub/slackware/slackware64-13.0/patches/package s/pidgin-2.7.3-x86_64-1_slack13.0.txz

Mandriva Linux Mandrake 2010.0 x86_64

• Mandriva finch-2.7.3-0.1mdv2010.0.x86_64.rpm
  http://www.mandriva.com/en/download/


• Mandriva lib64finch0-2.7.3-0.1mdv2010.0.x86_64.rpm
  http://www.mandriva.com/en/download/


• Mandriva lib64purple-devel-2.7.3-0.1mdv2010.0.x86_64.rpm
  http://www.mandriva.com/en/download/


• Mandriva lib64purple0-2.7.3-0.1mdv2010.0.x86_64.rpm
  http://www.mandriva.com/en/download/


• Mandriva pidgin-2.7.3-0.1mdv2010.0.x86_64.rpm
  http://www.mandriva.com/en/download/


• Mandriva pidgin-bonjour-2.7.3-0.1mdv2010.0.x86_64.rpm
  http://www.mandriva.com/en/download/


• Mandriva pidgin-client-2.7.3-0.1mdv2010.0.x86_64.rpm
  http://www.mandriva.com/en/download/


• Mandriva pidgin-i18n-2.7.3-0.1mdv2010.0.x86_64.rpm
  http://www.mandriva.com/en/download/


• Mandriva pidgin-meanwhile-2.7.3-0.1mdv2010.0.x86_64.rpm
  http://www.mandriva.com/en/download/


• Mandriva pidgin-perl-2.7.3-0.1mdv2010.0.x86_64.rpm
  http://www.mandriva.com/en/download/


• Mandriva pidgin-plugins-2.7.3-0.1mdv2010.0.x86_64.rpm
  http://www.mandriva.com/en/download/


• Mandriva pidgin-silc-2.7.3-0.1mdv2010.0.x86_64.rpm
  http://www.mandriva.com/en/download/


• Mandriva pidgin-tcl-2.7.3-0.1mdv2010.0.x86_64.rpm
  http://www.mandriva.com/en/download/

Slackware Linux 12.1

• Slackware pidgin-2.7.3-i486-1_slack12.1.tgz
  ftp://ftp.slackware.com/pub/slackware/slackware-12.1/patches/packages/ pidgin-2.7.3-i486-1_slack12.1.tgz

Slackware Linux x86_64 -current

• Slackware pidgin-2.7.3-x86_64-1.txz
  ftp://ftp.slackware.com/pub/slackware/slackware64-current/slackware64/ xap/pidgin-2.7.3-x86_64-1.txz

Slackware Linux 12.0

• Slackware pidgin-2.7.3-i486-1_slack12.0.tgz
  ftp://ftp.slackware.com/pub/slackware/slackware-12.0/patches/packages/ pidgin-2.7.3-i486-1_slack12.0.tgz

Mandriva Linux Mandrake 2010.1

• Mandriva finch-2.7.3-0.1mdv2010.1.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva libfinch0-2.7.3-0.1mdv2010.1.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva libpurple-devel-2.7.3-0.1mdv2010.1.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva libpurple0-2.7.3-0.1mdv2010.1.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva pidgin-2.7.3-0.1mdv2010.1.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva pidgin-bonjour-2.7.3-0.1mdv2010.1.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva pidgin-client-2.7.3-0.1mdv2010.1.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva pidgin-i18n-2.7.3-0.1mdv2010.1.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva pidgin-meanwhile-2.7.3-0.1mdv2010.1.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva pidgin-perl-2.7.3-0.1mdv2010.1.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva pidgin-plugins-2.7.3-0.1mdv2010.1.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva pidgin-silc-2.7.3-0.1mdv2010.1.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva pidgin-tcl-2.7.3-0.1mdv2010.1.i586.rpm
  http://www.mandriva.com/en/download/

Slackware Linux -current

• Slackware pidgin-2.7.3-i486-1.txz
  ftp://ftp.slackware.com/pub/slackware/slackware-current/slackware/xap/ pidgin-2.7.3-i486-1.txz

Mandriva Linux Mandrake 2009.0

• Mandriva finch-2.7.3-0.1mdv2009.0.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva libfinch0-2.7.3-0.1mdv2009.0.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva libpurple-devel-2.7.3-0.1mdv2009.0.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva libpurple0-2.7.3-0.1mdv2009.0.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva pidgin-2.7.3-0.1mdv2009.0.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva pidgin-bonjour-2.7.3-0.1mdv2009.0.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva pidgin-client-2.7.3-0.1mdv2009.0.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva pidgin-gevolution-2.7.3-0.1mdv2009.0.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva pidgin-i18n-2.7.3-0.1mdv2009.0.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva pidgin-meanwhile-2.7.3-0.1mdv2009.0.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva pidgin-perl-2.7.3-0.1mdv2009.0.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva pidgin-plugins-2.7.3-0.1mdv2009.0.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva pidgin-silc-2.7.3-0.1mdv2009.0.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva pidgin-tcl-2.7.3-0.1mdv2009.0.i586.rpm
  http://www.mandriva.com/en/download/

Slackware Linux 13.0

• Slackware pidgin-2.7.3-i486-1_slack13.0.txz
  ftp://ftp.slackware.com/pub/slackware/slackware-13.0/patches/packages/ pidgin-2.7.3-i486-1_slack13.0.txz

Slackware Linux 12.2

• Slackware pidgin-2.7.3-i486-1_slack12.2.tgz
  ftp://ftp.slackware.com/pub/slackware/slackware-12.2/patches/packages/ pidgin-2.7.3-i486-1_slack12.2.tgz

Mandriva Linux Mandrake 2009.0 x86_64

• Mandriva finch-2.7.3-0.1mdv2009.0.x86_64.rpm
  http://www.mandriva.com/en/download/


• Mandriva lib64finch0-2.7.3-0.1mdv2009.0.x86_64.rpm
  http://www.mandriva.com/en/download/


• Mandriva lib64purple-devel-2.7.3-0.1mdv2009.0.x86_64.rpm
  http://www.mandriva.com/en/download/


• Mandriva lib64purple0-2.7.3-0.1mdv2009.0.x86_64.rpm
  http://www.mandriva.com/en/download/


• Mandriva pidgin-2.7.3-0.1mdv2009.0.x86_64.rpm
  http://www.mandriva.com/en/download/


• Mandriva pidgin-bonjour-2.7.3-0.1mdv2009.0.x86_64.rpm
  http://www.mandriva.com/en/download/


• Mandriva pidgin-client-2.7.3-0.1mdv2009.0.x86_64.rpm
  http://www.mandriva.com/en/download/


• Mandriva pidgin-gevolution-2.7.3-0.1mdv2009.0.x86_64.rpm
  http://www.mandriva.com/en/download/


• Mandriva pidgin-i18n-2.7.3-0.1mdv2009.0.x86_64.rpm
  http://www.mandriva.com/en/download/


• Mandriva pidgin-meanwhile-2.7.3-0.1mdv2009.0.x86_64.rpm
  http://www.mandriva.com/en/download/


• Mandriva pidgin-perl-2.7.3-0.1mdv2009.0.x86_64.rpm
  http://www.mandriva.com/en/download/


• Mandriva pidgin-plugins-2.7.3-0.1mdv2009.0.x86_64.rpm
  http://www.mandriva.com/en/download/


• Mandriva pidgin-silc-2.7.3-0.1mdv2009.0.x86_64.rpm
  http://www.mandriva.com/en/download/


• Mandriva pidgin-tcl-2.7.3-0.1mdv2009.0.x86_64.rpm
  http://www.mandriva.com/en/download/

Mandriva Linux Mandrake 2008.0 x86_64

• Mandriva finch-2.7.3-0.1mdv2008.0.x86_64.rpm
  http://www.mandriva.com/en/download/


• Mandriva lib64finch0-2.7.3-0.1mdv2008.0.x86_64.rpm
  http://www.mandriva.com/en/download/


• Mandriva lib64purple-devel-2.7.3-0.1mdv2008.0.x86_64.rpm
  http://www.mandriva.com/en/download/


• Mandriva lib64purple0-2.7.3-0.1mdv2008.0.x86_64.rpm
  http://www.mandriva.com/en/download/


• Mandriva pidgin-2.7.3-0.1mdv2008.0.x86_64.rpm
  http://www.mandriva.com/en/download/


• Mandriva pidgin-bonjour-2.7.3-0.1mdv2008.0.x86_64.rpm
  http://www.mandriva.com/en/download/


• Mandriva pidgin-client-2.7.3-0.1mdv2008.0.x86_64.rpm
  http://www.mandriva.com/en/download/


• Mandriva pidgin-gevolution-2.7.3-0.1mdv2008.0.x86_64.rpm
  http://www.mandriva.com/en/download/


• Mandriva pidgin-i18n-2.7.3-0.1mdv2008.0.x86_64.rpm
  http://www.mandriva.com/en/download/


• Mandriva pidgin-meanwhile-2.7.3-0.1mdv2008.0.x86_64.rpm
  http://www.mandriva.com/en/download/


• Mandriva pidgin-perl-2.7.3-0.1mdv2008.0.x86_64.rpm
  http://www.mandriva.com/en/download/


• Mandriva pidgin-plugins-2.7.3-0.1mdv2008.0.x86_64.rpm
  http://www.mandriva.com/en/download/


• Mandriva pidgin-silc-2.7.3-0.1mdv2008.0.x86_64.rpm
  http://www.mandriva.com/en/download/


• Mandriva pidgin-tcl-2.7.3-0.1mdv2008.0.x86_64.rpm
  http://www.mandriva.com/en/download/

Mandriva Linux Mandrake 2008.0

• Mandriva finch-2.7.3-0.1mdv2008.0.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva libfinch0-2.7.3-0.1mdv2008.0.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva libpurple-devel-2.7.3-0.1mdv2008.0.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva libpurple0-2.7.3-0.1mdv2008.0.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva pidgin-2.7.3-0.1mdv2008.0.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva pidgin-bonjour-2.7.3-0.1mdv2008.0.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva pidgin-client-2.7.3-0.1mdv2008.0.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva pidgin-gevolution-2.7.3-0.1mdv2008.0.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva pidgin-i18n-2.7.3-0.1mdv2008.0.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva pidgin-meanwhile-2.7.3-0.1mdv2008.0.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva pidgin-perl-2.7.3-0.1mdv2008.0.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva pidgin-plugins-2.7.3-0.1mdv2008.0.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva pidgin-silc-2.7.3-0.1mdv2008.0.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva pidgin-tcl-2.7.3-0.1mdv2008.0.i586.rpm
  http://www.mandriva.com/en/download/

Slackware Linux 13.1 x86_64

• Slackware pidgin-2.7.3-x86_64-1_slack13.1.txz
  ftp://ftp.slackware.com/pub/slackware/slackware64-13.1/patches/package s/pidgin-2.7.3-x86_64-1_slack13.1.txz

Mandriva Linux Mandrake 2010.1 x86_64

• Mandriva finch-2.7.3-0.1mdv2010.1.x86_64.rpm
  http://www.mandriva.com/en/download/


• Mandriva lib64finch0-2.7.3-0.1mdv2010.1.x86_64.rpm
  http://www.mandriva.com/en/download/


• Mandriva lib64purple-devel-2.7.3-0.1mdv2010.1.x86_64.rpm
  http://www.mandriva.com/en/download/


• Mandriva lib64purple0-2.7.3-0.1mdv2010.1.x86_64.rpm
  http://www.mandriva.com/en/download/


• Mandriva pidgin-2.7.3-0.1mdv2010.1.x86_64.rpm
  http://www.mandriva.com/en/download/


• Mandriva pidgin-bonjour-2.7.3-0.1mdv2010.1.x86_64.rpm
  http://www.mandriva.com/en/download/


• Mandriva pidgin-client-2.7.3-0.1mdv2010.1.x86_64.rpm
  http://www.mandriva.com/en/download/


• Mandriva pidgin-i18n-2.7.3-0.1mdv2010.1.x86_64.rpm
  http://www.mandriva.com/en/download/


• Mandriva pidgin-meanwhile-2.7.3-0.1mdv2010.1.x86_64.rpm
  http://www.mandriva.com/en/download/


• Mandriva pidgin-perl-2.7.3-0.1mdv2010.1.x86_64.rpm
  http://www.mandriva.com/en/download/


• Mandriva pidgin-plugins-2.7.3-0.1mdv2010.1.x86_64.rpm
  http://www.mandriva.com/en/download/


• Mandriva pidgin-silc-2.7.3-0.1mdv2010.1.x86_64.rpm
  http://www.mandriva.com/en/download/


• Mandriva pidgin-tcl-2.7.3-0.1mdv2010.1.x86_64.rpm
  http://www.mandriva.com/en/download/

Slackware Linux 13.1

• Slackware pidgin-2.7.3-i486-1_slack13.1.txz
  ftp://ftp.slackware.com/pub/slackware/slackware-13.1/patches/packages/ pidgin-2.7.3-i486-1_slack13.1.txz

Mandriva Linux Mandrake 2010.0

• Mandriva finch-2.7.3-0.1mdv2010.0.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva libfinch0-2.7.3-0.1mdv2010.0.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva libpurple-devel-2.7.3-0.1mdv2010.0.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva libpurple0-2.7.3-0.1mdv2010.0.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva pidgin-2.7.3-0.1mdv2010.0.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva pidgin-bonjour-2.7.3-0.1mdv2010.0.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva pidgin-client-2.7.3-0.1mdv2010.0.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva pidgin-i18n-2.7.3-0.1mdv2010.0.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva pidgin-meanwhile-2.7.3-0.1mdv2010.0.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva pidgin-perl-2.7.3-0.1mdv2010.0.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva pidgin-plugins-2.7.3-0.1mdv2010.0.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva pidgin-silc-2.7.3-0.1mdv2010.0.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva pidgin-tcl-2.7.3-0.1mdv2010.0.i586.rpm
  http://www.mandriva.com/en/download/

Pidgin 'X-Status' Message Denial of Service Vulnerability

References:

• CVE-2010-2528 CVE-2010-1624 Denial of Service Vulnerabilities in Pidgin (Oracle)
  
• Pidgin Homepage (Pidgin)
  
• X-Status denial of service (Pidgin)