Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Date: Mon, 27 Dec 2010 14:39:43 +0100
From: Jan Lieskovsky <>
To: "Steven M. Christey" <>,
        oss-security <>
CC: John Bailey <>, Stu Tomlinson <>,
        Matthew Barnes <>
Subject: CVE Request -- Pidgin v2.7.6 <= x <= v2.7.8 -- MSN DirectConnect
 DoS (crash due NULL ptr dereference) after receiving a short P2P message

Hello Josh, Steve, vendors,

   Pidgin upstream has released the latest v2.7.9 version:

   addressing one security flaw in the MSN protocol:

   Upstream changeset:


   Further issue details from Stu Tomlinson (issue discoverer):
   <begin quote>
   I should clarify that because this is in the direct connection code it
   is not dependent on what the servers send us but rather what other
   clients send, so is susceptible to attack by malicious clients.

   I think only libpurple 2.7.6-2.7.8 are vulnerable because it was
   introduced by the MSN code remodelling that was merged in 2.7.6, not due
   to what the servers send.

   </end quote>

Could you allocate a CVE id for this issue?

Thanks && Regards, Jan.
Jan iankko Lieskovsky / Red Hat Security Response Team

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.