Pidgin Media Code Use Afer Free Race Condition Denial of Service Vulnerability

Bugtraq ID:	45021
Class:	Race Condition Error
CVE:
Remote:	Yes
Local:	No
Published:	Nov 23 2010 12:00AM
Updated:	Nov 23 2010 12:00AM
Credit:	Jakub Adam
Vulnerable:	Pidgin Pidgin 2.7.5 Pidgin Pidgin 2.7.4 Pidgin Pidgin 2.7.3 Pidgin Pidgin 2.7.2 Pidgin Pidgin 2.7.1 Pidgin Pidgin 2.7 Pidgin Pidgin 2.6.6 Pidgin Pidgin 2.6.5 Pidgin Pidgin 2.6.4 Pidgin Pidgin 2.6.3 Pidgin Pidgin 2.6.1 Pidgin Pidgin 2.6 Pidgin Pidgin 2.5.9 Pidgin Pidgin 2.5.8 Pidgin Pidgin 2.5.7 Pidgin Pidgin 2.5.6 Pidgin Pidgin 2.5.5 Pidgin Pidgin 2.4.3 Pidgin Pidgin 2.4.2 Pidgin Pidgin 2.4.1 Pidgin Pidgin 2.4 Pidgin Pidgin 2.2.2 Pidgin Pidgin 2.2.1 Pidgin Pidgin 2.2 Pidgin Pidgin 2.1 Pidgin Pidgin 2.0.2 Pidgin Pidgin 2.0
Not Vulnerable:	Pidgin Pidgin 2.7.6

Pidgin Media Code Use Afer Free Race Condition Denial of Service Vulnerability

Pidgin is prone to a denial-of-service vulnerability due to a use-after-free race condition.

Successful exploits will cause the affected application to crash, effectively denying service to legitimate users.

Pidgin versions prior to 2.7.6 are vulnerable.

Pidgin Media Code Use Afer Free Race Condition Denial of Service Vulnerability

Currently we are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected]

Pidgin Media Code Use Afer Free Race Condition Denial of Service Vulnerability

Solution:
Updates are available. Please see the references for more information.

Pidgin Media Code Use Afer Free Race Condition Denial of Service Vulnerability

References:

• ChangeLog: Pidgin and Finch - The Pimpin' Penguin IM Clients That're Good For Th (Pidgin)
  
• Pidgin Homepage (Pidgin)
  
• pidgin_request_timeout_cb should be removed in pidgin_media_dispose() (haakon)