Not a U.S. government website. NDD is an independent vulnerability database by Volerion and is not affiliated with or endorsed by NIST or NVD.

CVE-2009-1376 Details

Description

Multiple integer overflows in the msn_slplink_process_msg functions in the MSN protocol handler in (1) libpurple/protocols/msn/slplink.c and (2) libpurple/protocols/msnp9/slplink.c in Pidgin (formerly Gaim) before 2.5.6 on 32-bit platforms allow remote attackers to execute arbitrary code via a malformed SLP message with a crafted offset value, leading to buffer overflows. NOTE: this issue exists because of an incomplete fix for CVE-2008-2927.

Metrics

CVSS 3.x Severity and Vector Strings:

No CVSS 3.x data is available for this CVE.

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.

URL	Source(s)	Tag(s)
http://debian.org/security/2009/dsa-1805	CVE
https://bugzilla.redhat.com/show_bug.cgi?id=500493	CVE	Patch
http://secunia.com/advisories/35188	CVE
http://secunia.com/advisories/35194	CVE	Vendor Advisory
http://secunia.com/advisories/35202	CVE	Vendor Advisory
http://secunia.com/advisories/35215	CVE	Vendor Advisory
http://secunia.com/advisories/35294	CVE	Vendor Advisory
http://secunia.com/advisories/35329	CVE	Vendor Advisory
http://secunia.com/advisories/35330	CVE	Vendor Advisory
http://secunia.com/advisories/37071	CVE
https://exchange.xforce.ibmcloud.com/vulnerabilities/50680	CVE
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10476	CVE
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A18432	CVE
https://www.redhat.com/archives/fedora-package-announce/2009-June/msg00033.html	CVE
https://www.redhat.com/archives/fedora-package-announce/2009-June/msg00051.html	CVE
https://www.redhat.com/archives/fedora-package-announce/2009-June/msg00075.html	CVE
http://www.gentoo.org/security/en/glsa/glsa-200905-07.xml	CVE
http://www.mandriva.com/security/advisories?name=MDVSA-2009:140	CVE
http://www.mandriva.com/security/advisories?name=MDVSA-2009:173	CVE
http://www.pidgin.im/news/security/?id=32	CVE	Vendor Advisory
http://www.redhat.com/support/errata/RHSA-2009-1059.html	CVE
http://www.redhat.com/support/errata/RHSA-2009-1060.html	CVE
http://www.securityfocus.com/bid/35067	CVE
http://www.ubuntu.com/usn/USN-781-1	CVE
http://www.ubuntu.com/usn/USN-781-2	CVE
http://www.vupen.com/english/advisories/2009/1396	CVE
http://debian.org/security/2009/dsa-1805	[email protected]
https://bugzilla.redhat.com/show_bug.cgi?id=500493	[email protected]	Patch
http://secunia.com/advisories/35188	[email protected]
http://secunia.com/advisories/35194	[email protected]	Vendor Advisory
http://secunia.com/advisories/35202	[email protected]	Vendor Advisory
http://secunia.com/advisories/35215	[email protected]	Vendor Advisory
http://secunia.com/advisories/35294	[email protected]	Vendor Advisory
http://secunia.com/advisories/35329	[email protected]	Vendor Advisory
http://secunia.com/advisories/35330	[email protected]	Vendor Advisory
http://secunia.com/advisories/37071	[email protected]
https://exchange.xforce.ibmcloud.com/vulnerabilities/50680	[email protected]
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10476	[email protected]
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A18432	[email protected]
https://www.redhat.com/archives/fedora-package-announce/2009-June/msg00033.html	[email protected]
https://www.redhat.com/archives/fedora-package-announce/2009-June/msg00051.html	[email protected]
https://www.redhat.com/archives/fedora-package-announce/2009-June/msg00075.html	[email protected]
http://www.gentoo.org/security/en/glsa/glsa-200905-07.xml	[email protected]
http://www.mandriva.com/security/advisories?name=MDVSA-2009:140	[email protected]
http://www.mandriva.com/security/advisories?name=MDVSA-2009:173	[email protected]
http://www.pidgin.im/news/security/?id=32	[email protected]	Vendor Advisory
http://www.redhat.com/support/errata/RHSA-2009-1059.html	[email protected]
http://www.redhat.com/support/errata/RHSA-2009-1060.html	[email protected]
http://www.securityfocus.com/bid/35067	[email protected]
http://www.ubuntu.com/usn/USN-781-1	[email protected]
http://www.ubuntu.com/usn/USN-781-2	[email protected]
http://www.vupen.com/english/advisories/2009/1396	[email protected]

see all 52 references

Weakness Enumeration

CWE-ID	CWE Name	Source
CWE-189	Numeric Errors	[email protected]

Affected Products

Product	Versions
pidgin pidgin	<= 2.5.5 2.4.0 32_bit 2.4.1 32_bit 2.4.2 32_bit 2.4.3 32_bit
CPE cpe:2.3:a:pidgin:pidgin:::::::: cpe:2.3:a:pidgin:pidgin:2.4.0:32_bit:::::: cpe:2.3:a:pidgin:pidgin:2.4.1:32_bit:::::: cpe:2.3:a:pidgin:pidgin:2.4.2:32_bit:::::: cpe:2.3:a:pidgin:pidgin:2.4.3:32_bit:::::: cpe:2.3:a:pidgin:pidgin:2.5.0:32_bit:::::: cpe:2.3:a:pidgin:pidgin:2.5.2:32_bit:::::: cpe:2.3:a:pidgin:pidgin:2.5.3:32_bit:::::: cpe:2.3:a:pidgin:pidgin:2.5.4:32_bit:::::: Remediation No remediation found in references.

Product

Versions

pidgin pidgin

<= 2.5.5

2.4.0 32_bit

2.4.1 32_bit

2.4.2 32_bit

2.4.3 32_bit

CPE

cpe:2.3:a:pidgin:pidgin:*:*:*:*:*:*:*:*
cpe:2.3:a:pidgin:pidgin:2.4.0:32_bit:*:*:*:*:*:*
cpe:2.3:a:pidgin:pidgin:2.4.1:32_bit:*:*:*:*:*:*
cpe:2.3:a:pidgin:pidgin:2.4.2:32_bit:*:*:*:*:*:*
cpe:2.3:a:pidgin:pidgin:2.4.3:32_bit:*:*:*:*:*:*
cpe:2.3:a:pidgin:pidgin:2.5.0:32_bit:*:*:*:*:*:*
cpe:2.3:a:pidgin:pidgin:2.5.2:32_bit:*:*:*:*:*:*
cpe:2.3:a:pidgin:pidgin:2.5.3:32_bit:*:*:*:*:*:*
cpe:2.3:a:pidgin:pidgin:2.5.4:32_bit:*:*:*:*:*:*

Remediation

No remediation found in references.

Change History

9 change records found show changes

Date	Action	Recorded By
Jun 16, 2026	CVE Modified	[email protected]
Apr 23, 2026	Status Change	[email protected]
Nov 21, 2024	CVE Modified	CVE
May 14, 2024	CVE Modified	[email protected]
Nov 7, 2023	CVE Modified	[email protected]
Feb 13, 2023	CVE Modified	[email protected]
Sep 29, 2017	CVE Modified	[email protected]
Aug 17, 2017	CVE Modified	[email protected]
May 26, 2009	Initial Analysis	[email protected]