CVE-2009-3085 Denial of service in n/a
Remote attackers can crash the Pidgin application by sending specially crafted XHTML-IM content with cid: images via the XMPP protocol.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2009-3085?
CVE-2009-3085 is a medium-severity denial of service vulnerability in Pidgin Pidgin, published on 8 Sep 2009. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The XMPP protocol plugin in libpurple in Pidgin before 2.6.2 does not properly handle an error IQ stanza during an attempted fetch of a custom smiley, which allows remote attackers to cause a denial of service (application crash) via XHTML-IM content with cid: images.
Which versions are affected by CVE-2009-3085?
It affects 2 products.
Products include Pidgin Libpurple, Pidgin Pidgin.
How do I fix CVE-2009-3085?
Upgrade to a fixed version.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2009-3085 being exploited?
There is no known exploitation of CVE-2009-3085 in the wild and no public exploit code.
Other vulnerabilities in Pidgin Pidgin
- CVE-2009-2703 Null dereference in n/a
- CVE-2009-3083 Null dereference in n/a
- CVE-2009-3084 The msn_slp_process_msg function in libpurple/protocols/msn/slpcall.c in the MSN protocol plugin in libpurple 2.6.0 and 2.6.1, as used in Pi
- CVE-2011-3594 Memory corruption in n/a
- CVE-2011-2943 Null dereference in n/a
Sources
Also known as DEBIAN-CVE-2009-3085, GHSA-pqhg-j5hh-cx9v.