https://security.imfreedom.org/ Recent content in About on IMFreedom Security Hugo en Thu, 28 Apr 2022 10:40:22 +0000 https://security.imfreedom.org/advisories/cve-2022-26491/ Thu, 28 Apr 2022 10:40:22 +0000 https://security.imfreedom.org/advisories/cve-2022-26491/ <h3 id="description">Description</h3> <p>If not using DNSSEC it is trivial to perform a man in the middle attack a client via DNS spoofing. You can find more discussion in the <a href="https://mail.jabber.org/pipermail/standards/2022-February/038759.html">XMPP Standards Archives</a>.</p> <h3 id="mitigation">Mitigation</h3> <p>Removed the code that supported the <code>_xmppconnect</code> DNS TXT record.</p> https://security.imfreedom.org/advisories/cve-2017-2640-00/ Thu, 09 Mar 2017 00:00:00 +0000 https://security.imfreedom.org/advisories/cve-2017-2640-00/ <h3 id="description">Description</h3> <p>An out-of-bounds write when invalid xml is sent by a malicious server.</p> <h3 id="mitigation">Mitigation</h3> <p>Only decode HTML entities that are well formed.</p> https://security.imfreedom.org/advisories/cve-2016-2367-00/ Tue, 21 Jun 2016 00:00:00 +0000 https://security.imfreedom.org/advisories/cve-2016-2367-00/ <h3 id="description">Description</h3> <p>A malicious user, server, or man-in-the-middle could trigger a crash or unexpected writing of data from memory to file.</p> <h3 id="mitigation">Mitigation</h3> <p>Various changes to the chunk decoding.</p> https://security.imfreedom.org/advisories/cve-2016-2373-00/ Tue, 21 Jun 2016 00:00:00 +0000 https://security.imfreedom.org/advisories/cve-2016-2373-00/ <h3 id="description">Description</h3> <p>A malicious user, server, or man-in-the-middle could trigger a crash.</p> <h3 id="mitigation">Mitigation</h3> <p>Validate the received value.</p> https://security.imfreedom.org/advisories/cve-2016-2369-00/ Tue, 21 Jun 2016 00:00:00 +0000 https://security.imfreedom.org/advisories/cve-2016-2369-00/ <h3 id="description">Description</h3> <p>A malicious server or man-in-the-middle could trigger a crash.</p> <h3 id="mitigation">Mitigation</h3> https://security.imfreedom.org/advisories/cve-2016-2370-00/ Tue, 21 Jun 2016 00:00:00 +0000 https://security.imfreedom.org/advisories/cve-2016-2370-00/ <h3 id="description">Description</h3> <p>A malicious server or man-in-the-middle could trigger a crash.</p> <h3 id="mitigation">Mitigation</h3> <p>Various changes to the chunk decoding.</p> https://security.imfreedom.org/advisories/cve-2016-2371-00/ Tue, 21 Jun 2016 00:00:00 +0000 https://security.imfreedom.org/advisories/cve-2016-2371-00/ <h3 id="description">Description</h3> <p>A malicious server or man-in-the-middle could trigger a crash or potentially arbitrary code execution.</p> <h3 id="mitigation">Mitigation</h3> <p>Check the field count before accessing fields.</p> https://security.imfreedom.org/advisories/cve-2016-2372-00/ Tue, 21 Jun 2016 00:00:00 +0000 https://security.imfreedom.org/advisories/cve-2016-2372-00/ <h3 id="description">Description</h3> <p>A malicious user, server, or man-in-the-middle could trigger a crash or unexpected writing of data from memory to file.</p> <h3 id="mitigation">Mitigation</h3> <p>Various changes to the chunk decoding.</p> https://security.imfreedom.org/advisories/cve-2016-2368-00/ Tue, 21 Jun 2016 00:00:00 +0000 https://security.imfreedom.org/advisories/cve-2016-2368-00/ <h3 id="description">Description</h3> <p>Data is copied without verifying that it was copied successfully.</p> <h3 id="mitigation">Mitigation</h3> <p>Separate the handling of HTTP headers and body. Check the return value from <code>g_vsnprintf()</code>.</p> https://security.imfreedom.org/advisories/cve-2016-2378-00/ Tue, 21 Jun 2016 00:00:00 +0000 https://security.imfreedom.org/advisories/cve-2016-2378-00/ <h3 id="description">Description</h3> <p>A malicious server or man-in-the-middle could trigger a crash.</p> <h3 id="mitigation">Mitigation</h3> <p>Use correct data types.</p> https://security.imfreedom.org/advisories/cve-2016-2377-00/ Tue, 21 Jun 2016 00:00:00 +0000 https://security.imfreedom.org/advisories/cve-2016-2377-00/ <h3 id="description">Description</h3> <p>A malicious server or man-in-the-middle could trigger a crash.</p> <h3 id="mitigation">Mitigation</h3> <p>Use an unsigned integer.</p> https://security.imfreedom.org/advisories/cve-2016-2365-00/ Tue, 21 Jun 2016 00:00:00 +0000 https://security.imfreedom.org/advisories/cve-2016-2365-00/ <h3 id="description">Description</h3> <p>A malicious server or man-in-the-middle could trigger a crash.</p> <h3 id="mitigation">Mitigation</h3> <p>Escape the provided filename before using it.</p> https://security.imfreedom.org/advisories/cve-2016-2374-00/ Tue, 21 Jun 2016 00:00:00 +0000 https://security.imfreedom.org/advisories/cve-2016-2374-00/ <h3 id="description">Description</h3> <p>A malicious server or man-in-the-middle could trigger a crash or potentially arbitrary code execution.</p> <h3 id="mitigation">Mitigation</h3> <p>Validate the incoming message format.</p> https://security.imfreedom.org/advisories/cve-2016-2380-00/ Tue, 21 Jun 2016 00:00:00 +0000 https://security.imfreedom.org/advisories/cve-2016-2380-00/ <h3 id="description">Description</h3> <p>A specially crafted local message (by the user or a plugin) could lead to the disclosure of 7 bytes to the server.</p> <h3 id="mitigation">Mitigation</h3> <p>Check the length of the font tag.</p> https://security.imfreedom.org/advisories/cve-2016-2376-00/ Tue, 21 Jun 2016 00:00:00 +0000 https://security.imfreedom.org/advisories/cve-2016-2376-00/ <h3 id="description">Description</h3> <p>A malicious server or man-in-the-middle could trigger a crash or potentially arbitrary code execution.</p> <h3 id="mitigation">Mitigation</h3> <p>Verify the size from the packet.</p> https://security.imfreedom.org/advisories/cve-2016-4323-00/ Tue, 21 Jun 2016 00:00:00 +0000 https://security.imfreedom.org/advisories/cve-2016-4323-00/ <h3 id="description">Description</h3> <p>A malicious server or man-in-the-middle could trigger libpurple to overwrite a local file with the name and contents specified by the attacker.</p> <h3 id="mitigation">Mitigation</h3> https://security.imfreedom.org/advisories/cve-2016-2375-00/ Tue, 21 Jun 2016 00:00:00 +0000 https://security.imfreedom.org/advisories/cve-2016-2375-00/ <h3 id="description">Description</h3> <p>A malicious server or man-in-the-middle could trigger a crash or disclosure of information from memory.</p> <h3 id="mitigation">Mitigation</h3> <p>Validate the field and attribute counts.</p> https://security.imfreedom.org/advisories/cve-2016-2366-00/ Tue, 21 Jun 2016 00:00:00 +0000 https://security.imfreedom.org/advisories/cve-2016-2366-00/ <h3 id="description">Description</h3> <p>A malicious server or man-in-the-middle could trigger a crash.</p> <h3 id="mitigation">Mitigation</h3> <p>Validate the data length. Use the correct data types.</p> https://security.imfreedom.org/advisories/cve-2016-1000030-00/ Tue, 21 Jun 2016 00:00:00 +0000 https://security.imfreedom.org/advisories/cve-2016-1000030-00/ <h3 id="description">Description</h3> <p>X.509 certificates may be improperly imported when using GnuTLS.</p> <h3 id="mitigation">Mitigation</h3> <p>Check return values from <code>gnutls_x509_crt_init()</code> and <code>gnutls_x509_crt_import()</code>.</p> https://security.imfreedom.org/advisories/cve-2014-3694-00/ Wed, 22 Oct 2014 00:00:00 +0000 https://security.imfreedom.org/advisories/cve-2014-3694-00/ <h3 id="description">Description</h3> <p>Both of libpurple&rsquo;s bundled SSL/TLS plugins (one for GnuTLS and one for NSS) failed to check that the Basic Constraints extension allowed intermediate certificates to act as CAs. This allowed anyone with any valid certificate to create a fake certificate for any arbitrary domain and Pidgin would trust it.</p> <h3 id="mitigation">Mitigation</h3> <p>Both bundled plugins were changed to check the Basic Constraints extension on all intermediate CA certificates.</p> https://security.imfreedom.org/advisories/cve-2014-3697-00/ Wed, 22 Oct 2014 00:00:00 +0000 https://security.imfreedom.org/advisories/cve-2014-3697-00/ <h3 id="description">Description</h3> <p>A bug in the untar code on Windows could allow a malicious smiley theme to place a file anywhere on the file system, or alter an existing file when installing a smiley theme via drag and drop on Windows.</p> <h3 id="mitigation">Mitigation</h3> <p>Fix the untar code to ensure all paths are relative.</p> https://security.imfreedom.org/advisories/cve-2014-3698-00/ Wed, 22 Oct 2014 00:00:00 +0000 https://security.imfreedom.org/advisories/cve-2014-3698-00/ <h3 id="description">Description</h3> <p>A malicious server and possibly even a malicious remote user could create a carefully crafted XMPP message that causes libpurple to send an XMPP message containing arbitrary memory.</p> <h3 id="mitigation">Mitigation</h3> <p>Correctly determine the start and end position of buffers when performing stringprep.</p> https://security.imfreedom.org/advisories/cve-2014-3696-00/ Wed, 22 Oct 2014 00:00:00 +0000 https://security.imfreedom.org/advisories/cve-2014-3696-00/ <h3 id="description">Description</h3> <p>A malicious server or man-in-the-middle could trigger a crash in libpurple by specifying that a large amount of memory should be allocated in many places in the UI.</p> <h3 id="mitigation">Mitigation</h3> <p>Impose a maximum length when reading various types of messages.</p> https://security.imfreedom.org/advisories/cve-2014-3695-00/ Wed, 22 Oct 2014 00:00:00 +0000 https://security.imfreedom.org/advisories/cve-2014-3695-00/ <h3 id="description">Description</h3> <p>A malicious server or man-in-the-middle could trigger a crash in libpurple by sending an emoticon with an overly large length value.</p> <h3 id="mitigation">Mitigation</h3> <p>Verify that the length value is valid before attempting to read data from the buffer.</p> https://security.imfreedom.org/advisories/cve-2013-6487-00/ Tue, 28 Jan 2014 00:00:00 +0000 https://security.imfreedom.org/advisories/cve-2013-6487-00/ <h3 id="description">Description</h3> <p>A malicious server or man-in-the-middle could send a large value for Content-Length and cause an integer overflow which could lead to a buffer overflow.</p> <h3 id="mitigation">Mitigation</h3> <p>Enforce a maximum size for content-length.</p> https://security.imfreedom.org/advisories/cve-2013-6489-00/ Tue, 28 Jan 2014 00:00:00 +0000 https://security.imfreedom.org/advisories/cve-2013-6489-00/ <h3 id="description">Description</h3> <p>A specially crafted emoticon value could cause an integer overflow which could lead to a buffer overflow.</p> <h3 id="mitigation">Mitigation</h3> <p>Use an unsigned integer and enforce a maximum size.</p> https://security.imfreedom.org/advisories/cve-2013-6485-00/ Tue, 28 Jan 2014 00:00:00 +0000 https://security.imfreedom.org/advisories/cve-2013-6485-00/ <h3 id="description">Description</h3> <p>A malicious server or man-in-the-middle could cause a buffer overflow by sending a malformed HTTP response with chunked Transfer-Encoding with invalid chunk sizes.</p> <h3 id="mitigation">Mitigation</h3> <p>Enforce a maximum size for chunks.</p> https://security.imfreedom.org/advisories/cve-2013-6477-00/ Tue, 28 Jan 2014 00:00:00 +0000 https://security.imfreedom.org/advisories/cve-2013-6477-00/ <h3 id="description">Description</h3> <p>A remote XMPP user can trigger a crash on some systems by sending a message with a timestamp in the distant future.</p> <h3 id="mitigation">Mitigation</h3> <p>Avoid passing negative timestamps to <code>localtime()</code>.</p> https://security.imfreedom.org/advisories/cve-2013-6484-00/ Tue, 28 Jan 2014 00:00:00 +0000 https://security.imfreedom.org/advisories/cve-2013-6484-00/ <h3 id="description">Description</h3> <p>Incorrect error handling when reading the response from a STUN server could lead to a crash.</p> <h3 id="mitigation">Mitigation</h3> <p>Fix error handling.</p> https://security.imfreedom.org/advisories/cve-2013-6478-00/ Tue, 28 Jan 2014 00:00:00 +0000 https://security.imfreedom.org/advisories/cve-2013-6478-00/ <h3 id="description">Description</h3> <p>libX11 forcefully exits when Pidgin tries to create an exceptionally wide tooltip window.</p> <p><a href="https://lists.pidgin.im/pipermail/support/2013-March/012980.html">support email #1</a></p> <p><a href="https://lists.pidgin.im/pipermail/support/2013-March/012981.html">support email #2</a></p> <h3 id="mitigation">Mitigation</h3> <p>Only display the first 200 characters of the URL in the tooltip.</p> https://security.imfreedom.org/advisories/cve-2013-6482-01/ Tue, 28 Jan 2014 00:00:00 +0000 https://security.imfreedom.org/advisories/cve-2013-6482-01/ <h3 id="description">Description</h3> <p>A malformed Content-Length header could lead to a NULL pointer dereference.</p> <h3 id="mitigation">Mitigation</h3> <p>Check to make sure the Content-Length header has a value.</p> https://security.imfreedom.org/advisories/cve-2013-6482-02/ Tue, 28 Jan 2014 00:00:00 +0000 https://security.imfreedom.org/advisories/cve-2013-6482-02/ <h3 id="description">Description</h3> <p>A malicious server or man-in-the-middle could send us a specially-crafted XML response that results in a NULL pointer dereference.</p> <h3 id="mitigation">Mitigation</h3> <p>Check for NULL before calling <code>atoi()</code>.</p> https://security.imfreedom.org/advisories/cve-2013-6482-03/ Tue, 28 Jan 2014 00:00:00 +0000 https://security.imfreedom.org/advisories/cve-2013-6482-03/ <h3 id="description">Description</h3> <p>A malicious server or man-in-the-middle could send us a specially-crafted SOAP response that results in a NULL pointer dereference.</p> <h3 id="mitigation">Mitigation</h3> <p>Check for NULL before using values.</p> https://security.imfreedom.org/advisories/cve-2013-6486-00/ Tue, 28 Jan 2014 00:00:00 +0000 https://security.imfreedom.org/advisories/cve-2013-6486-00/ <h3 id="description">Description</h3> <p>If a user clicks on a file:// URI in a received IM in Windows builds of Pidgin, Pidgin attempts to execute the file. This can be dangerous if the file:// URI is a path on a network share. This was originally reported in <a href="https://security.imfreedom.org/advisories/cve-2011-3185-00/">CVE-2011-3185</a> in 2011 and we attempted to fix it then, but failed.</p> <h3 id="mitigation">Mitigation</h3> <p>Don&rsquo;t attempt to execute files when the user clicks a file:// URI. Instead, open a file browser at the file&rsquo;s location.</p> https://security.imfreedom.org/advisories/cve-2013-6479-00/ Tue, 28 Jan 2014 00:00:00 +0000 https://security.imfreedom.org/advisories/cve-2013-6479-00/ <h3 id="description">Description</h3> <p>A malicious server or man-in-the-middle could send a malformed HTTP response that could lead to a crash.</p> <h3 id="mitigation">Mitigation</h3> <p>Validate response before using it.</p> https://security.imfreedom.org/advisories/cve-2013-6481-00/ Tue, 28 Jan 2014 00:00:00 +0000 https://security.imfreedom.org/advisories/cve-2013-6481-00/ <h3 id="description">Description</h3> <p>The Yahoo! protocol plugin failed to validate a length field before trying to read from a buffer, which could result in reading past the end of the buffer which could cause a crash.</p> <h3 id="mitigation">Mitigation</h3> <p>Check that the length is within range.</p> https://security.imfreedom.org/advisories/cve-2014-0020-00/ Tue, 28 Jan 2014 00:00:00 +0000 https://security.imfreedom.org/advisories/cve-2014-0020-00/ <h3 id="description">Description</h3> <p>A malicious server or man-in-the-middle could trigger a crash in libpurple by sending a message with fewer than expected arguments.</p> <h3 id="mitigation">Mitigation</h3> <p>Verify that incoming messages contain the appropriate number of arguments before handling them.</p> https://security.imfreedom.org/advisories/cve-2013-6483-00/ Tue, 28 Jan 2014 00:00:00 +0000 https://security.imfreedom.org/advisories/cve-2013-6483-00/ <h3 id="description">Description</h3> <p>The XMPP protocol plugin failed to ensure that iq replies came from the person they were sent to. A remote user could send a spoofed iq reply and attempt to guess the iq id. This could allow an attacker to inject fake data or trigger a null pointer dereference.</p> <h3 id="mitigation">Mitigation</h3> <p>Keep track of the &rsquo;to&rsquo; when sending an iq stanza and make sure replies for a given stanza ID come from the same address it was sent to.</p> https://security.imfreedom.org/advisories/cve-2012-6152-00/ Sat, 28 Jan 2012 00:00:00 +0000 https://security.imfreedom.org/advisories/cve-2012-6152-00/ <h3 id="description">Description</h3> <p>Many places in the Yahoo! protocol plugin assumed incoming strings were UTF-8 and failed to transcode from non-UTF-8 encodings. This can lead to a crash when receiving strings that aren&rsquo;t UTF-8.</p> <h3 id="mitigation">Mitigation</h3> <p>Depending on the context, either validate that a string is UTF-8 or transcode the string from the appropriate encoding to UTF-8.</p> https://security.imfreedom.org/advisories/cve-2011-4602-00/ Sat, 10 Dec 2011 00:00:00 +0000 https://security.imfreedom.org/advisories/cve-2011-4602-00/ <h3 id="description">Description</h3> <p>When receiving various stanzas related to voice and video chat, the XMPP protocol plugin failed to ensure that the incoming message contained all required fields, and would crash if certain fields were missing.</p> <h3 id="mitigation">Mitigation</h3> <p>Check for missing fields and handle them appropriately.</p> https://security.imfreedom.org/advisories/cve-2011-4601-00/ Thu, 20 Oct 2011 00:00:00 +0000 https://security.imfreedom.org/advisories/cve-2011-4601-00/ <h3 id="description">Description</h3> <p>When receiving various messages related to requesting or receiving authorization for adding a buddy to a buddy list, the oscar protocol plugin failed to validate that a piece of text was UTF-8. In some cases invalid UTF-8 data would lead to a crash.</p> <h3 id="mitigation">Mitigation</h3> <p>Validate incoming strings as UTF-8 before using them as such.</p> https://security.imfreedom.org/advisories/cve-2011-3594-00/ Thu, 29 Sep 2011 00:00:00 +0000 https://security.imfreedom.org/advisories/cve-2011-3594-00/ <h3 id="description">Description</h3> <p>When receiving various incoming messages, the SILC protocol plugin failed to validate that a piece of text was UTF-8. In some cases invalid UTF-8 data would lead to a crash.</p> <h3 id="mitigation">Mitigation</h3> <p>Validate incoming strings as UTF-8 before using them as such.</p> https://security.imfreedom.org/advisories/cve-2011-4603-00/ Thu, 29 Sep 2011 00:00:00 +0000 https://security.imfreedom.org/advisories/cve-2011-4603-00/ <h3 id="description">Description</h3> <p>When receiving various incoming messages, the SILC protocol plugin failed to validate that a piece of text was UTF-8. In some cases invalid UTF-8 data would lead to a crash. This vulnerability is similar to CVE-2011-3594, but occurs in a different piece of code and was fixed at a later date.</p> <h3 id="mitigation">Mitigation</h3> <p>Validate incoming strings as UTF-8 before using them as such.</p> https://security.imfreedom.org/advisories/cve-2011-3185-00/ Sat, 20 Aug 2011 00:00:00 +0000 https://security.imfreedom.org/advisories/cve-2011-3185-00/ <h3 id="description">Description</h3> <p>If a user clicks on a file:// URI in a received IM in Windows builds of Pidgin, Pidgin attempts to execute the file. This can be dangerous if the file:// URI is a path on a network share.</p> <h3 id="mitigation">Mitigation</h3> <p>Don&rsquo;t attempt to execute files when the user clicks a file:// URI. Instead, open a file browser at the file&rsquo;s location.</p> https://security.imfreedom.org/advisories/cve-2011-2943-00/ Sat, 20 Aug 2011 00:00:00 +0000 https://security.imfreedom.org/advisories/cve-2011-2943-00/ <h3 id="description">Description</h3> <p>Certain characters in the nicknames of IRC users can trigger a null pointer dereference in the IRC protocol plugin&rsquo;s handling of responses to WHO requests. This can cause a crash on some operating systems. Clients based on libpurple 2.8.0 through 2.9.0 are affected.</p> <h3 id="mitigation">Mitigation</h3> <p>Change libpurple to validate the data it receives from the server before attempting to use it.</p> https://security.imfreedom.org/advisories/cve-2011-3184-00/ Sat, 20 Aug 2011 00:00:00 +0000 https://security.imfreedom.org/advisories/cve-2011-3184-00/ <h3 id="description">Description</h3> <p>Incorrect handling of HTTP 100 responses in the MSN protocol plugin can cause the application to attempt to access memory that it does not have access to. This only affects users who have turned on the HTTP connection method for their accounts (it&rsquo;s off by default). This might only be triggerable by a malicious server and not a malicious peer. We believe remote code execution is not possible.</p> <h3 id="mitigation">Mitigation</h3> <p>Correctly take into account the size of HTTP 100 response when parsing server messages.</p> https://security.imfreedom.org/advisories/cve-2011-4939-00/ Fri, 08 Jul 2011 00:00:00 +0000 https://security.imfreedom.org/advisories/cve-2011-4939-00/ <h3 id="description">Description</h3> <p>Certain types of nickname changes in XMPP chat rooms can trigger a NULL pointer dereference in Pidgin, which triggers a crash.</p> <h3 id="mitigation">Mitigation</h3> <p>Check for NULL before trying to use a struct.</p> https://security.imfreedom.org/advisories/cve-2011-2485-00/ Thu, 23 Jun 2011 00:00:00 +0000 https://security.imfreedom.org/advisories/cve-2011-2485-00/ <h3 id="description">Description</h3> <p>It was found that the gdk-pixbuf GIF image loader routine <code>gdk_pixbuf__gif_image_load()</code> did not properly handle certain return values from its subroutines. A remote attacker could provide a specially-crafted GIF image, which, once opened in Pidgin, would lead gdk-pixbuf to return a partially initialized pixbuf structure. Using this structure, possibly containing a huge width and height, could lead to the application being terminated due to excessive memory use.</p> <h3 id="mitigation">Mitigation</h3> <p>Change Pidgin to look at the GError parameter in addition to the return value when calling certain gdk-pixbuf functions.</p> https://security.imfreedom.org/advisories/cve-2011-1091-00/ Thu, 10 Mar 2011 00:00:00 +0000 https://security.imfreedom.org/advisories/cve-2011-1091-00/ <h3 id="description">Description</h3> <p>The Yahoo protocol plugin in libpurple versions 2.6.0 through 2.7.10 do not properly handle malformed YMSG packets, leading to NULL pointer dereferences and application crash.</p> <h3 id="mitigation">Mitigation</h3> <p>Properly handle malformed packets by ignoring the packet or the missing field.</p> https://security.imfreedom.org/advisories/independent-20110206-00/ Sun, 06 Feb 2011 00:00:00 +0000 https://security.imfreedom.org/advisories/independent-20110206-00/ <h3 id="description">Description</h3> <p>It was discovered that libpurple versions prior to 2.7.10 do not properly clear certain data structures used in <code>libpurple/cipher.c</code> prior to freeing. An attacker could potentially extract partial information from memory regions freed by libpurple.</p> <h3 id="mitigation">Mitigation</h3> <p>Proper structure clearing has been implemented.</p> https://security.imfreedom.org/advisories/cve-2010-4528-00/ Sun, 26 Dec 2010 00:00:00 +0000 https://security.imfreedom.org/advisories/cve-2010-4528-00/ <h3 id="description">Description</h3> <p>It was discovered that libpurple 2.7.6 through 2.7.8 did not properly handle &ldquo;short&rdquo; packets in MSN direct connection sessions, leading to a crash due to a NULL pointer dereference. Malicious clients or users can exploit this to cause a denial of service (crash).</p> <h3 id="mitigation">Mitigation</h3> <p>Ignore short packets.</p> https://security.imfreedom.org/advisories/cve-2010-3711-00/ Wed, 20 Oct 2010 00:00:00 +0000 https://security.imfreedom.org/advisories/cve-2010-3711-00/ <h3 id="description">Description</h3> <p>It has been discovered that eight denial of service conditions exist in libpurple all due to insufficient validation of the return value from <code>purple_base64_decode()</code>. Invalid or malformed data received in place of a valid base64-encoded value in portions of the Yahoo!, MSN, MySpaceIM, and XMPP protocol plugins and the NTLM authentication support trigger a crash. These vulnerabilities can be leveraged by a remote user for denial of service.</p> <h3 id="mitigation">Mitigation</h3> <p>Check the return value from <code>purple_base64_decode()</code> before trying to use it.</p> https://security.imfreedom.org/advisories/cve-2010-2528-00/ Wed, 21 Jul 2010 00:00:00 +0000 https://security.imfreedom.org/advisories/cve-2010-2528-00/ <h3 id="description">Description</h3> <p>Certain incorrectly formed X-Status messages can cause libpurple to attempt to dereference a NULL pointer, which triggers a crash.</p> <h3 id="mitigation">Mitigation</h3> <p>Improve the parsing of the X-Status message to be more robust.</p> https://security.imfreedom.org/advisories/cve-2010-1624-00/ Wed, 12 May 2010 00:00:00 +0000 https://security.imfreedom.org/advisories/cve-2010-1624-00/ <h3 id="description">Description</h3> <p>A vulnerability was discovered in libpurple&rsquo;s MSN protocol plugin that can cause a denial of service (crash) due to insufficient validation of certain SLP packets related to custom emoticons. An attacker could use this vulnerability to remotely crash a client using libpurple for MSN. It is not possible for this vulnerability to be exploited for code execution. As a workaround, disabling custom emoticons on MSN accounts will prevent the vulnerability.</p> https://security.imfreedom.org/advisories/cve-2010-0420-00/ Thu, 18 Feb 2010 00:00:00 +0000 https://security.imfreedom.org/advisories/cve-2010-0420-00/ <h3 id="description">Description</h3> <p>If a user in a multi-user chat room has a nickname containing <code>&lt;br&gt;</code> then libpurple ends up having two users with username <code>' '</code> in the room, and Finch crashes in this situation. We do not believe there is a possibility of remote code execution.</p> <h3 id="mitigation">Mitigation</h3> <p>Correctly parse <code>&lt;br&gt;</code> so that it appears literally rather than as <code>' '</code>.</p> https://security.imfreedom.org/advisories/cve-2010-0277-00/ Thu, 18 Feb 2010 00:00:00 +0000 https://security.imfreedom.org/advisories/cve-2010-0277-00/ <h3 id="description">Description</h3> <p>Certain malformed SLP messages can trigger a crash because the MSN protocol plugin fails to check that all pieces of the message are set correctly.</p> <h3 id="mitigation">Mitigation</h3> <p>Validate input before attempting to handle the message.</p> https://security.imfreedom.org/advisories/cve-2010-0423-00/ Thu, 18 Feb 2010 00:00:00 +0000 https://security.imfreedom.org/advisories/cve-2010-0423-00/ <h3 id="description">Description</h3> <p>oCERT notified us about a problem in Pidgin, where a large amount of processing time will be used when inserting many smileys into an IM or chat window. This should not cause a crash, but Pidgin can become unusably slow.</p> <h3 id="mitigation">Mitigation</h3> <p>A limit was added for the maximum number of smileys allowed in a conversation.</p> https://security.imfreedom.org/advisories/cve-2010-0013-00/ Fri, 08 Jan 2010 00:00:00 +0000 https://security.imfreedom.org/advisories/cve-2010-0013-00/ <h3 id="description">Description</h3> <p>The MSN protocol plugin extracts the filename of a custom emoticon from an incoming request and uploads that file without correlating the filename to a valid custom emoticon.</p> <h3 id="mitigation">Mitigation</h3> <p>Validate the custom emoticon requested is valid before uploading its file data.</p> https://security.imfreedom.org/advisories/cve-2009-3615-00/ Fri, 16 Oct 2009 00:00:00 +0000 https://security.imfreedom.org/advisories/cve-2009-3615-00/ <h3 id="description">Description</h3> <p>A specially crafted message can trigger an incorrect memory access in the oscar protocol plugin which can lead to a crash. This happens when the SIM IM client attempts to send contacts to a libpurple user.</p> <h3 id="mitigation">Mitigation</h3> <p>Check for the correct number of fields before attempting to dereference memory.</p> https://security.imfreedom.org/advisories/cve-2009-2703-00/ Thu, 03 Sep 2009 00:00:00 +0000 https://security.imfreedom.org/advisories/cve-2009-2703-00/ <h3 id="description">Description</h3> <p>A specially crafted IRC TOPIC message can trigger a NULL pointer dereference in the IRC protocol plugin&rsquo;s code for handling IRC topics.</p> <h3 id="mitigation">Mitigation</h3> <p>Correctly ignore invalid TOPIC messages sent from the server.</p> https://security.imfreedom.org/advisories/cve-2009-3084-00/ Thu, 03 Sep 2009 00:00:00 +0000 https://security.imfreedom.org/advisories/cve-2009-3084-00/ <h3 id="description">Description</h3> <p>The MSN protocol plugin used an incorrect character encoding when attempting to convert handwritten messages from one encoding to another. This caused the conversion to fail. This failure combined with an uninitialized variable can trigger a crash. The only vulnerable versions of libpurple are 2.6.0 and 2.6.1.</p> <h3 id="mitigation">Mitigation</h3> <p>Use the correct character set name and initialize error to NULL.</p> https://security.imfreedom.org/advisories/cve-2009-3083-00/ Thu, 03 Sep 2009 00:00:00 +0000 https://security.imfreedom.org/advisories/cve-2009-3083-00/ <h3 id="description">Description</h3> <p>The MSN protocol plugin extracts some fields from an incoming SLP invite. If some of these fields do not exist in the invite message then the protocol plugin will attempt to dereference a NULL pointer and will crash.</p> <h3 id="mitigation">Mitigation</h3> <p>Check for NULL values and handle appropriately.</p> https://security.imfreedom.org/advisories/cve-2009-3085-00/ Thu, 03 Sep 2009 00:00:00 +0000 https://security.imfreedom.org/advisories/cve-2009-3085-00/ <h3 id="description">Description</h3> <p>The XMPP protocol plugin can crash when attempting to process an error response as a custom smiley. libpurple 2.5.2 through 2.6.1 are vulnerable. Older versions may be vulnerable as well.</p> <h3 id="mitigation">Mitigation</h3> <p>Handle error iq responses appropriately.</p> https://security.imfreedom.org/advisories/cve-2009-3026-00/ Thu, 03 Sep 2009 00:00:00 +0000 https://security.imfreedom.org/advisories/cve-2009-3026-00/ <h3 id="description">Description</h3> <p>The XMPP protocol plugin can be tricked into establishing an insecure connection by a malicious man in the middle by causing libpurple to use the older IQ-based login and then not offering TLS/SSL. The &ldquo;require TLS/SSL&rdquo; option was introduced in 2.2.0.</p> <h3 id="mitigation">Mitigation</h3> <p>Respect the &ldquo;require TLS/SSL&rdquo; preference for this type of connection.</p> https://security.imfreedom.org/advisories/cve-2009-3025-00/ Sat, 22 Aug 2009 00:00:00 +0000 https://security.imfreedom.org/advisories/cve-2009-3025-00/ <h3 id="description">Description</h3> <p>Possibly depending on the architecture and/or flags used to compile libpurple, the Yahoo protocol plugin may crash when receiving an IM from any user which contains a URL. The only vulnerable version of libpurple is 2.6.0.</p> <h3 id="mitigation">Mitigation</h3> <p>Correctly parse URLs in incoming Yahoo messages.</p> https://security.imfreedom.org/advisories/cve-2009-2694-00/ Tue, 18 Aug 2009 00:00:00 +0000 https://security.imfreedom.org/advisories/cve-2009-2694-00/ <h3 id="description">Description</h3> <p>By sending two consecutive specially crafted SLP messages it is possible to trigger an memcpy to an invalid location in memory. This affects all versions of libpurple and Gaim released in the past few years.</p> <h3 id="mitigation">Mitigation</h3> <p>Correctly destroy outgoing SLP ACK messages after they are sent, and ensure a buffer has been allocated within the SLP data structure before attempting to write to it.</p> https://security.imfreedom.org/advisories/cve-2009-1889-00/ Thu, 28 May 2009 00:00:00 +0000 https://security.imfreedom.org/advisories/cve-2009-1889-00/ <h3 id="description">Description</h3> <p>The ICQ prpl would misparse an incoming ICQ Web Message as an SMS message in certain circumstances, leading to an excessively large allocation.</p> <h3 id="mitigation">Mitigation</h3> <p>Yuriy&rsquo;s patch corrected the misparsing of such ICQ web messages so they are no longer treated as SMS messages and added validation to avoid unnecessary memory allocations.</p> https://security.imfreedom.org/advisories/cve-2009-1374-00/ Sun, 03 May 2009 00:00:00 +0000 https://security.imfreedom.org/advisories/cve-2009-1374-00/ <h3 id="description">Description</h3> <p><code>decrypt_out()</code> always writes 8 bytes past the supplied buffer, which is always allocated on the stack. We don&rsquo;t believe this can cause anything outside of a crash.</p> <h3 id="mitigation">Mitigation</h3> <p><code>decrypt_out()</code> is fixed to not write past the end of the buffer.</p> https://security.imfreedom.org/advisories/cve-2009-1376-00/ Sat, 02 May 2009 00:00:00 +0000 https://security.imfreedom.org/advisories/cve-2009-1376-00/ <h3 id="description">Description</h3> <p>The previous fix to <a href="https://security.imfreedom.org/advisories/cve-2008-2927-00/">CVE-2008-2927</a> was deemed incomplete. The size check improperly cast an <code>uint64</code> to <code>size_t</code> which can cause an integer overflow, rendering the check useless.</p> <h3 id="mitigation">Mitigation</h3> <p>The proper variable type is now used when doing size comparison. Additionally, the malformed message is now properly discarded.</p> https://security.imfreedom.org/advisories/cve-2009-1373-00/ Sat, 02 May 2009 00:00:00 +0000 https://security.imfreedom.org/advisories/cve-2009-1373-00/ <h3 id="description">Description</h3> <p>The XMPP SOCKS5 bytestream server was not correctly checking the bounds of a buffer when initiating an outgoing file transfer.</p> <h3 id="mitigation">Mitigation</h3> <p>The affected function has been patched to fix the vulnerability.</p> https://security.imfreedom.org/advisories/cve-2009-1375-00/ Fri, 20 Mar 2009 00:00:00 +0000 https://security.imfreedom.org/advisories/cve-2009-1375-00/ <h3 id="description">Description</h3> <p>A buffer maintained by <code>PurpleCircBuffer</code> may be corrupted if it&rsquo;s exactly full and then more bytes are added to it, leading to a crash. This structure is used by the XMPP and Sametime protocol plugins.</p> <h3 id="mitigation">Mitigation</h3> <p>PurpleCircBuffer now correctly checks bounds.</p> https://security.imfreedom.org/advisories/cve-2008-3532-00/ Fri, 25 Jul 2008 00:00:00 +0000 https://security.imfreedom.org/advisories/cve-2008-3532-00/ <h3 id="description">Description</h3> <p>The NSS SSL implementation in libpurple does not verify SSL certificates, which makes it easier for remote attackers to trick a user into accepting an invalid server certificate for a spoofed service.</p> <h3 id="mitigation">Mitigation</h3> <p>SSL/TLS Certificates are now verified in the NSS implementation in libpurple.</p> https://security.imfreedom.org/advisories/cve-2008-2927-00/ Tue, 01 Jul 2008 00:00:00 +0000 https://security.imfreedom.org/advisories/cve-2008-2927-00/ <h3 id="description">Description</h3> <p>Multiple integer overflows in the <code>msn_slplink_process_msg</code> functions in the MSN protocol handler in libpurple allow remote attackers to execute arbitrary code via a malformed SLP message.</p> <h3 id="mitigation">Mitigation</h3> <p>The affected function has been patched to fix the vulnerability.</p> https://security.imfreedom.org/advisories/cve-2008-2955-00/ Wed, 25 Jun 2008 00:00:00 +0000 https://security.imfreedom.org/advisories/cve-2008-2955-00/ <h3 id="description">Description</h3> <p>A remote MSN user can cause a denial of service (crash) by sending a file with a file with a filename containing invalid characters. The local user must then accept the file transfer to trigger a double-free.</p> <h3 id="mitigation">Mitigation</h3> <p>A fix was applied to ensure that the double-free didn&rsquo;t occur.</p> https://security.imfreedom.org/advisories/cve-2008-2957-00/ Sun, 11 May 2008 00:00:00 +0000 https://security.imfreedom.org/advisories/cve-2008-2957-00/ <h3 id="description">Description</h3> <p>The UPnP functionality in libpurple allows remote attackers to trigger the download of arbitrary files and cause a denial of service (memory or disk consumption) via a UDP packet that specifies an arbitrary URL.</p> <h3 id="mitigation">Mitigation</h3> <p>UPnP related downloads are limited to 128kB.</p> https://security.imfreedom.org/advisories/cve-2007-4999-00/ Wed, 24 Oct 2007 00:00:00 +0000 https://security.imfreedom.org/advisories/cve-2007-4999-00/ <h3 id="description">Description</h3> <p>A remote user can cause a denial of service (crash) by sending a message with invalid HTML. It is believed that this crash can be triggered only when using HTML logging.</p> <h3 id="mitigation">Mitigation</h3> <p>The affected function has been patched to fix the vulnerability.</p> https://security.imfreedom.org/advisories/cve-2007-4996-00/ Thu, 27 Sep 2007 00:00:00 +0000 https://security.imfreedom.org/advisories/cve-2007-4996-00/ <h3 id="description">Description</h3> <p>A remote MSN user that is not on the buddy list can cause a denial of service (crash) by sending a nudge message. The protocol plugin attempts to look up the buddy&rsquo;s information and accesses an invalid memory location if the user is not on the buddy list. This only affects libpurple version 2.2.0, older versions are not affected.</p> <h3 id="mitigation">Mitigation</h3> <p>The nudge functionality in the MSN protocol has been rewritten to avoid an unnecessary lookup of buddy information.</p> https://security.imfreedom.org/advisories/cve-2005-2103-00/ Thu, 11 Aug 2005 00:00:00 +0000 https://security.imfreedom.org/advisories/cve-2005-2103-00/ <h3 id="description">Description</h3> <p>A remote AIM or ICQ user can cause a buffer overflow in Gaim by setting an away message containing many AIM substitution strings (such as <code>%t</code> or <code>%n</code>).</p> <h3 id="mitigation">Mitigation</h3> <p>The substitution function was modified to use a dynamic buffer instead of one with a fixed size.</p> https://security.imfreedom.org/advisories/cve-2005-2102-00/ Thu, 11 Aug 2005 00:00:00 +0000 https://security.imfreedom.org/advisories/cve-2005-2102-00/ <h3 id="description">Description</h3> <p>A remote user could cause Gaim to crash on some systems by sending the Gaim user a file whose filename contains certain invalid characters. It is unknown what combination of systems are affected, but it is suspected that Windows users and systems with older versions of GTK are especially susceptible.</p> <h3 id="mitigation">Mitigation</h3> <p>The filename is validated as UTF-8 before Gaim attempts to display it.</p> https://security.imfreedom.org/advisories/cve-2005-2370-00/ Thu, 11 Aug 2005 00:00:00 +0000 https://security.imfreedom.org/advisories/cve-2005-2370-00/ <h3 id="description">Description</h3> <p>There was a memory alignment bug in the library Gaim uses to access the Gadu-Gadu network. This bug can not be exploited on x86 architectures. This bug was recently fixed in the libgadu library, but also needed to be fixed in Gaim because Gaim includes a copy of the libgadu library.</p> <h3 id="mitigation">Mitigation</h3> <p>The vulnerable section of code was modified to work correctly on all architectures.</p> https://security.imfreedom.org/advisories/cve-2005-1934-00/ Fri, 10 Jun 2005 00:00:00 +0000 https://security.imfreedom.org/advisories/cve-2005-1934-00/ <h3 id="description">Description</h3> <p>Remote attackers can cause a denial of service (crash) via a malformed MSN message that leads to a memory allocation of a large size, possibly due to an integer signedness error.</p> <h3 id="mitigation">Mitigation</h3> <p>Added a check for the invalid message.</p> https://security.imfreedom.org/advisories/cve-2005-1269-00/ Fri, 10 Jun 2005 00:00:00 +0000 https://security.imfreedom.org/advisories/cve-2005-1269-00/ <h3 id="description">Description</h3> <p>Remove denial of service when being offered files with names containing non-ASCII characters.</p> <h3 id="mitigation">Mitigation</h3> <p>Attempt to convert the file name to a usable encoding, or fail gracefully in the case of an invalid file name.</p> https://security.imfreedom.org/advisories/cve-2005-1262-00/ Tue, 10 May 2005 00:00:00 +0000 https://security.imfreedom.org/advisories/cve-2005-1262-00/ <h3 id="description">Description</h3> <p>Potential remote denial of service bug resulting from not checking a pointer for non-<code>NULL</code> before passing it to strncmp, which results in a crash. This can be triggered by a remote client sending an SLP message with an empty body.</p> <h3 id="mitigation">Mitigation</h3> <p>Check for <code>NULL</code> before attempting to use the pointer.</p> https://security.imfreedom.org/advisories/cve-2005-1261-00/ Tue, 10 May 2005 00:00:00 +0000 https://security.imfreedom.org/advisories/cve-2005-1261-00/ <h3 id="description">Description</h3> <p>It is possible for a remote user to overflow a static buffer by sending an IM containing a very large URL (greater than 8192 bytes) to the Gaim user. This is not possible on all protocols, due to message length restrictions. Jabber are SILC are known to be vulnerable.</p> <h3 id="mitigation">Mitigation</h3> <p>The URL parsing function was modified to not use a static buffer.</p> https://security.imfreedom.org/advisories/cve-2005-0967-00/ Mon, 04 Apr 2005 00:00:00 +0000 https://security.imfreedom.org/advisories/cve-2005-0967-00/ <h3 id="description">Description</h3> <p>Sending a Gaim Jabber user a certain invalid file transfer request triggers an out-of-bounds read which causes Gaim to crash.</p> <h3 id="mitigation">Mitigation</h3> <p>The invalid file transfer request is ignored.</p> https://security.imfreedom.org/advisories/cve-2005-0966-00/ Sat, 02 Apr 2005 00:00:00 +0000 https://security.imfreedom.org/advisories/cve-2005-0966-00/ <h3 id="description">Description</h3> <p>The IRC protocol plugin in Gaim 1.2.0, and possibly earlier versions, allows:</p> <ol> <li>remote attackers to inject arbitrary Gaim markup via <code>irc_msg_kick</code>, <code>irc_msg_mode</code>, <code>irc_msg_part</code>, <code>irc_msg_quit</code>,</li> <li>remote attackers to inject arbitrary Pango markup and pop up empty dialog boxes via <code>irc_msg_invite</code>, or</li> <li>malicious IRC servers to cause a denial of service (application crash) by injecting certain Pango markup into <code>irc_msg_badmode</code>, <code>irc_msg_banned</code>, <code>irc_msg_unknown</code>, <code>irc_msg_nochan</code> functions.</li> </ol> <h3 id="mitigation">Mitigation</h3> <p>The IRC protocol plugin was modified to escape appropriate messages passed to the Gaim core.</p> https://security.imfreedom.org/advisories/cve-2005-0965-00/ Sat, 02 Apr 2005 00:00:00 +0000 https://security.imfreedom.org/advisories/cve-2005-0965-00/ <h3 id="description">Description</h3> <p>The <code>gaim_markup_strip_html</code> function in Gaim 1.2.0, and possibly earlier versions, allows remote attackers to cause a denial of service (application crash) via a string that contains malformed HTML, which causes an out-of-bounds read.</p> <h3 id="mitigation">Mitigation</h3> <p>The function was changed to not allow the out-of-bounds read.</p> https://security.imfreedom.org/advisories/cve-2005-0208-00/ Thu, 24 Feb 2005 00:00:00 +0000 https://security.imfreedom.org/advisories/cve-2005-0208-00/ <h3 id="description">Description</h3> <p>Remote crash. Receiving malformed HTML can result in an invalid memory access causing Gaim to crash.</p> <h3 id="mitigation">Mitigation</h3> <p>The HTML parsing functions were modified to correctly parse the malformed HTML.</p> https://security.imfreedom.org/advisories/cve-2005-0472-00/ Thu, 17 Feb 2005 00:00:00 +0000 https://security.imfreedom.org/advisories/cve-2005-0472-00/ <h3 id="description">Description</h3> <p>Certain malformed SNAC packets sent by other AIM or ICQ users can trigger an infinite loop in Gaim when parsing the SNAC. The remote user would need a custom client, able to generate malformed SNACs.</p> <h3 id="mitigation">Mitigation</h3> <p>The OSCAR protocol plugin was modified to drop these malformed packets.</p> https://security.imfreedom.org/advisories/cve-2005-0473-00/ Thu, 17 Feb 2005 00:00:00 +0000 https://security.imfreedom.org/advisories/cve-2005-0473-00/ <h3 id="description">Description</h3> <p>Remote crash. Receiving malformed HTML can result in an invalid memory access causing Gaim to crash.</p> <h3 id="mitigation">Mitigation</h3> <p>The HTML parsing functions were modified to correctly parse the malformed HTML.</p> https://security.imfreedom.org/advisories/independent-20041019-00/ Tue, 19 Oct 2004 00:00:00 +0000 https://security.imfreedom.org/advisories/independent-20041019-00/ <h3 id="description">Description</h3> <p>Remote crash. After accepting a file transfer request, Gaim will attempt to allocate a buffer of a size equal to the entire filesize, this allocation attempt will cause Gaim to crash if the size exceeds the amount of available memory.</p> <h3 id="mitigation">Mitigation</h3> <p>Don&rsquo;t allocate a buffer for file transfers.</p> https://security.imfreedom.org/advisories/cve-2004-0891-00/ Tue, 19 Oct 2004 00:00:00 +0000 https://security.imfreedom.org/advisories/cve-2004-0891-00/ <h3 id="description">Description</h3> <p>Buffer overflow. <code>memcpy</code> was used without checking the size of the buffer before copying to it. Additionally, a logic flaw was causing the wrong buffer to be used as the destination for the copy under certain circumstances.</p> <h3 id="mitigation">Mitigation</h3> <p>Correct the logic to select the correct buffer, and add bounds checking to prevent malformed messages causing a buffer overflow.</p> https://security.imfreedom.org/advisories/independent-20041019-01/ Tue, 19 Oct 2004 00:00:00 +0000 https://security.imfreedom.org/advisories/independent-20041019-01/ <h3 id="description">Description</h3> <p>Remote crash. Gaim allocates a buffer for the payload of each message received based on the size field in the header of the message. A malicious peer could specify an invalid size that exceeds the amount of available memory.</p> <h3 id="mitigation">Mitigation</h3> <p>Replace call to <code>g_malloc()</code> with call to <code>g_try_malloc()</code>. If the memory could not be allocated the function returns instead of causing the application to crash.</p> https://security.imfreedom.org/advisories/independent-20040826-00/ Thu, 26 Aug 2004 00:00:00 +0000 https://security.imfreedom.org/advisories/independent-20040826-00/ <h3 id="description">Description</h3> <p>Remote crash. When a remote server provides a large <code>content-length</code> header value, Gaim will attempt to allocate a buffer to store the content, however this allocation attempt will cause Gaim to crash if the length exceeds the amount of possible memory. This happens when reading profile information on some protocols. It also happens when smiley themes are installed via drag and drop.</p> <h3 id="mitigation">Mitigation</h3> <p>The call to <code>g_malloc()</code> was replaced with a call to <code>g_try_malloc()</code>. If the memory could not be allocated the function returns instead of causing the application to crash.</p> https://security.imfreedom.org/advisories/cve-2004-0754-00/ Thu, 26 Aug 2004 00:00:00 +0000 https://security.imfreedom.org/advisories/cve-2004-0754-00/ <h3 id="description">Description</h3> <p>Integer overflow in memory allocation results in heap overflow. By passing the size variable as <code>~0</code>, integer overflows to 0 when 1 is added in <code>g_alloc()</code>. A <code>malloc(0)</code> call results in 16 bytes of memory being allocated on IA- 32. Then we can overflow the heap when <code>nm_read_all()</code> is called next step. Usually cases like this suck for exploitation, because the len (<code>~0</code>) is so large that a following call to <code>memcpy()</code> or <code>strcpy()</code> will just run into kernel mem or unmapped address and fault. However in this case we read the data from the network via a <code>read()</code> call, so we can just stop sending data and close the connection to short out before <code>~0</code> bytes are read. However, this is triggered by input from the server, not directly from a client. Someone running a malicious groupware server could leverage this to run arbitrary code on the client.</p> https://security.imfreedom.org/advisories/cve-2004-0785-01/ Thu, 26 Aug 2004 00:00:00 +0000 https://security.imfreedom.org/advisories/cve-2004-0785-01/ <h3 id="description">Description</h3> <p>Buffer overflow. If the local computer&rsquo;s host name is not in /etc/hosts, and the computer performs a DNS query to obtain its hostname when signing on to zephyr, it could receive a reply with a hostname greater than <code>MAXHOSTNAMELEN</code> (generally 64 bytes). If <code>gethostbyname()</code> does not ensure the size of <code>hostent-&gt;h_name</code> is less than <code>MAXHOSTNAMELEN</code>, this value would be copied to a buffer that is not large enough.</p> <h3 id="mitigation">Mitigation</h3> <p>The calls to copy the hostname were replaced with calls that check the length of the destination buffer.</p> https://security.imfreedom.org/advisories/cve-2004-0785-02/ Thu, 26 Aug 2004 00:00:00 +0000 https://security.imfreedom.org/advisories/cve-2004-0785-02/ <h3 id="description">Description</h3> <p>Buffer overflow. There are some loops that read into fixed-sized buffers and do not check to make sure they are not writing too much.</p> <h3 id="mitigation">Mitigation</h3> <p>Added bounds checking to the two loops.</p> https://security.imfreedom.org/advisories/cve-2004-0785-00/ Thu, 26 Aug 2004 00:00:00 +0000 https://security.imfreedom.org/advisories/cve-2004-0785-00/ <h3 id="description">Description</h3> <p>Buffer overflow. The URL is decoded into a static buffer of length 2048 bytes. I&rsquo;m not sure it&rsquo;s possible to receive a URL longer than 2048 bytes, as many protocols have message limits that are shorter than that.</p> <h3 id="mitigation">Mitigation</h3> <p>A check to make sure the source string is shorter than 2048 bytes is performed.</p> https://security.imfreedom.org/advisories/cve-2004-0500-00/ Sun, 22 Aug 2004 00:00:00 +0000 https://security.imfreedom.org/advisories/cve-2004-0500-00/ <h3 id="description">Description</h3> <p>In two places in the MSN protocol plugins (<code>object.c</code> and <code>slp.c</code>), <code>strncpy</code> was used incorrectly. The size of the array was not checked before copying to it. Both bugs affect MSN&rsquo;s MSNSLP protocol, which is peer-to-peer, so this could potentially be easy to exploit.</p> <h3 id="mitigation">Mitigation</h3> <p>Bounds checking was added in both places.</p> https://security.imfreedom.org/advisories/cve-2004-0784-00/ Sun, 22 Aug 2004 00:00:00 +0000 https://security.imfreedom.org/advisories/cve-2004-0784-00/ <h3 id="description">Description</h3> <p>To install a new smiley theme, a user can drag a tarball from a graphical file manager, or a hypertext link to one from a web browser. When a tarball is dragged, Gaim executes a shell command to untar it. However, it does not escape the filename before sending it to the shell. Thus, a specially crafted filename could execute arbitrary commands if the user could be convinced to drag a file into the smiley theme selector.</p> https://security.imfreedom.org/contact/ Mon, 01 Jan 0001 00:00:00 +0000 https://security.imfreedom.org/contact/ <p>If you believe you have discovered a security problem or vulnerability in in an Instant Messaging Freedom affiliated <a href="https://security.imfreedom.org/projects">project</a>, please let us know by using one of the following methods:</p> <ul> <li><strong>Our preferred way:</strong> Emailing <a href="mailto:security@imfreedom.org">security@imfreedom.org</a>.</li> <li>Use this specific <a href="https://issues.imfreedom.org/newIssue?project=PIDGIN&amp;c=visible+to+Security">new issue</a> link, which will create a new issue in our issue tracker while ensuring that its visibility is set so that it&rsquo;s only visible to the <code>Security</code> group. The visibility selection we are referring to can be verified by looking for it right above the <em>Create</em> button. Setting a limited visibility is of <em>utmost</em> importance as otherwise we&rsquo;d need to consider the vulnerability to have been made public since everyone could read it from our issue tracker.</li> </ul>