VDB

CVE-2009-2694

CVE-2009-2694 PUBLISHED CVSS 10 CRITICAL

The msn_slplink_process_msg function in libpurple/protocols/msn/slplink.c in libpurple, as used in Pidgin (formerly Gaim) before 2.5.9 and Adium 1.3.5 and earlier, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) by sending multiple crafted SLP (aka MSNSLP) messages to trigger an overwrite of an arbitrary memory location. NOTE: this issue reportedly exists because of an incomplete fix for CVE-2009-1376.

EPSS 34.71% · 97.1th percentile

Risk Scores

CVSS 2.0
10
EPSS Score
34.71%
97.1th percentile

Affected Products

VendorProductVersions
adiumadium1.3, 1.3.1, 1.3.3
pidginpidgin2.2.2, 2.3.0, 2.3.1
n/an/an/a

Exploit Intelligence

…and 12 more exploits

Timeline

  • Aug 20, 2009 CVE Published
  • Sep 8, 2009 PoC Published
  • Sep 9, 2009 PoC Published
  • Feb 4, 2022 EPSS Score
  • Mar 29, 2022 EPSS Score
  • Jul 12, 2022 EPSS Score
  • Sep 4, 2022 EPSS Score
  • Oct 26, 2022 EPSS Score
  • Feb 9, 2023 EPSS Score
  • Mar 7, 2023 EPSS Score
  • Apr 3, 2023 EPSS Score
  • May 25, 2023 EPSS Score

References

Open in Interactive Console →
$ Console Community · 100/wk Open console ›