CVE-2011-1091

libymsg.c in the Yahoo! protocol plugin in libpurple in Pidgin 2.6.0 through 2.7.10 allows (1) remote authenticated users to cause a denial of service (NULL pointer dereference and application crash) via a malformed YMSG notification packet, and allows (2) remote Yahoo! servers to cause a denial of service (NULL pointer dereference and application crash) via a malformed YMSG SMS message.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
4 UNKNOWN
NETWORK
LOW
AV:N/AC:L/Au:S/C:N/I:N/A:P
Base Score
CVSS 3.x
EPSS Score
Percentile: 81%
Affected Products (NVD)
VendorProductVersion
pidginpidgin
2.6.0
pidginpidgin
2.6.1
pidginpidgin
2.6.2
pidginpidgin
2.6.4
pidginpidgin
2.6.5
pidginpidgin
2.6.6
pidginpidgin
2.7.0
pidginpidgin
2.7.1
pidginpidgin
2.7.2
pidginpidgin
2.7.3
pidginpidgin
2.7.4
pidginpidgin
2.7.5
pidginpidgin
2.7.6
pidginpidgin
2.7.7
pidginpidgin
2.7.8
pidginpidgin
2.7.9
pidginpidgin
2.7.10
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
pidgin
bookworm
2.14.12-1
fixed
bullseye
2.14.1-1
fixed
lenny
no-dsa
sid
2.14.13-2
fixed
squeeze
no-dsa
trixie
2.14.13-2
fixed
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
pidgin
dapper
dne
hardy
ignored
karmic
ignored
lucid
Fixed 1:2.6.6-1ubuntu4.4
released
maverick
Fixed 1:2.7.3-1ubuntu3.3
released
natty
Fixed 1:2.7.11-1ubuntu1
released
oneiric
Fixed 1:2.7.11-1ubuntu1
released
openSUSE logo
openSUSE / SLES Releases
openSUSE Product
Release
finch
suse enterprise desktop 12
2.10.9-5.15
fixed
suse enterprise desktop 12 SP1
2.10.9-8.1
fixed
suse enterprise desktop 12 SP2
2.11.0-12.5
fixed
suse enterprise desktop 12 SP3
2.12.0-1.33
fixed
suse enterprise desktop 12 SP4
2.12.0-3.3.1
fixed
suse enterprise sap 12
2.10.9-5.15
fixed
suse enterprise sap 12 SP1
2.10.9-8.1
fixed
suse enterprise sap 12 SP2
2.11.0-12.5
fixed
suse enterprise sap 12 SP3
2.12.0-1.33
fixed
suse enterprise sap 12 SP4
2.12.0-3.3.1
fixed
suse enterprise sap 12 SP5
2.12.0-3.3.1
fixed
suse enterprise server 12
2.10.9-5.15
fixed
suse enterprise server 12 SP1
2.10.9-8.1
fixed
suse enterprise server 12 SP2
2.11.0-12.5
fixed
suse enterprise server 12 SP3
2.12.0-1.33
fixed
suse enterprise server 12 SP4
2.12.0-3.3.1
fixed
suse enterprise server 12 SP5
2.12.0-3.3.1
fixed
suse enterprise workstation 12
2.10.9-5.15
fixed
suse enterprise workstation 12 SP1
2.10.9-8.1
fixed
suse enterprise workstation 12 SP2
2.11.0-12.5
fixed
suse enterprise workstation 12 SP3
2.12.0-1.33
fixed
suse enterprise workstation 12 SP4
2.12.0-3.3.1
fixed
suse enterprise workstation 12 SP5
2.12.0-3.3.1
fixed
libpurple
suse enterprise desktop 12
2.10.9-5.15
fixed
suse enterprise desktop 12 SP1
2.10.9-8.1
fixed
suse enterprise desktop 12 SP2
2.11.0-12.5
fixed
suse enterprise desktop 12 SP3
2.12.0-1.33
fixed
suse enterprise desktop 12 SP4
2.12.0-3.3.1
fixed
suse enterprise sap 12
2.10.9-5.15
fixed
suse enterprise sap 12 SP1
2.10.9-8.1
fixed
suse enterprise sap 12 SP2
2.11.0-12.5
fixed
suse enterprise sap 12 SP3
2.12.0-1.33
fixed
suse enterprise sap 12 SP4
2.12.0-3.3.1
fixed
suse enterprise sap 12 SP5
2.12.0-3.3.1
fixed
suse enterprise server 12
2.10.9-5.15
fixed
suse enterprise server 12 SP1
2.10.9-8.1
fixed
suse enterprise server 12 SP2
2.11.0-12.5
fixed
suse enterprise server 12 SP3
2.12.0-1.33
fixed
suse enterprise server 12 SP4
2.12.0-3.3.1
fixed
suse enterprise server 12 SP5
2.12.0-3.3.1
fixed
suse enterprise workstation 12
2.10.9-5.15
fixed
suse enterprise workstation 12 SP1
2.10.9-8.1
fixed
suse enterprise workstation 12 SP2
2.11.0-12.5
fixed
suse enterprise workstation 12 SP3
2.12.0-1.33
fixed
suse enterprise workstation 12 SP4
2.12.0-3.3.1
fixed
suse enterprise workstation 12 SP5
2.12.0-3.3.1
fixed
libpurple-branding-upstream
suse enterprise desktop 12 SP3
2.12.0-1.33
fixed
suse enterprise desktop 12 SP4
2.12.0-3.3.1
fixed
suse enterprise sap 12 SP3
2.12.0-1.33
fixed
suse enterprise sap 12 SP4
2.12.0-3.3.1
fixed
suse enterprise sap 12 SP5
2.12.0-3.3.1
fixed
suse enterprise server 12 SP3
2.12.0-1.33
fixed
suse enterprise server 12 SP4
2.12.0-3.3.1
fixed
suse enterprise server 12 SP5
2.12.0-3.3.1
fixed
suse enterprise workstation 12 SP3
2.12.0-1.33
fixed
suse enterprise workstation 12 SP4
2.12.0-3.3.1
fixed
suse enterprise workstation 12 SP5
2.12.0-3.3.1
fixed
libpurple-lang
suse enterprise desktop 12
2.10.9-5.15
fixed
suse enterprise desktop 12 SP1
2.10.9-8.1
fixed
suse enterprise desktop 12 SP2
2.11.0-12.5
fixed
suse enterprise desktop 12 SP3
2.12.0-1.33
fixed
suse enterprise desktop 12 SP4
2.12.0-3.3.1
fixed
suse enterprise sap 12
2.10.9-5.15
fixed
suse enterprise sap 12 SP1
2.10.9-8.1
fixed
suse enterprise sap 12 SP2
2.11.0-12.5
fixed
suse enterprise sap 12 SP3
2.12.0-1.33
fixed
suse enterprise sap 12 SP4
2.12.0-3.3.1
fixed
suse enterprise sap 12 SP5
2.12.0-3.3.1
fixed
suse enterprise server 12
2.10.9-5.15
fixed
suse enterprise server 12 SP1
2.10.9-8.1
fixed
suse enterprise server 12 SP2
2.11.0-12.5
fixed
suse enterprise server 12 SP3
2.12.0-1.33
fixed
suse enterprise server 12 SP4
2.12.0-3.3.1
fixed
suse enterprise server 12 SP5
2.12.0-3.3.1
fixed
suse enterprise workstation 12
2.10.9-5.15
fixed
suse enterprise workstation 12 SP1
2.10.9-8.1
fixed
suse enterprise workstation 12 SP2
2.11.0-12.5
fixed
suse enterprise workstation 12 SP3
2.12.0-1.33
fixed
suse enterprise workstation 12 SP4
2.12.0-3.3.1
fixed
suse enterprise workstation 12 SP5
2.12.0-3.3.1
fixed
libpurple-meanwhile
suse enterprise desktop 12
2.10.9-5.15
fixed
suse enterprise desktop 12 SP1
2.10.9-8.1
fixed
suse enterprise desktop 12 SP2
2.11.0-12.5
fixed
suse enterprise sap 12
2.10.9-5.15
fixed
suse enterprise sap 12 SP1
2.10.9-8.1
fixed
suse enterprise sap 12 SP2
2.11.0-12.5
fixed
suse enterprise server 12
2.10.9-5.15
fixed
suse enterprise server 12 SP1
2.10.9-8.1
fixed
suse enterprise server 12 SP2
2.11.0-12.5
fixed
suse enterprise workstation 12
2.10.9-5.15
fixed
suse enterprise workstation 12 SP1
2.10.9-8.1
fixed
suse enterprise workstation 12 SP2
2.11.0-12.5
fixed
libpurple-plugin-sametime
suse enterprise desktop 12 SP3
2.12.0-1.33
fixed
suse enterprise desktop 12 SP4
2.12.0-3.3.1
fixed
suse enterprise sap 12 SP3
2.12.0-1.33
fixed
suse enterprise sap 12 SP4
2.12.0-3.3.1
fixed
suse enterprise sap 12 SP5
2.12.0-3.3.1
fixed
suse enterprise server 12 SP3
2.12.0-1.33
fixed
suse enterprise server 12 SP4
2.12.0-3.3.1
fixed
suse enterprise server 12 SP5
2.12.0-3.3.1
fixed
suse enterprise workstation 12 SP3
2.12.0-1.33
fixed
suse enterprise workstation 12 SP4
2.12.0-3.3.1
fixed
suse enterprise workstation 12 SP5
2.12.0-3.3.1
fixed
libpurple-tcl
suse enterprise desktop 12
2.10.9-5.15
fixed
suse enterprise desktop 12 SP1
2.10.9-8.1
fixed
suse enterprise desktop 12 SP2
2.11.0-12.5
fixed
suse enterprise desktop 12 SP3
2.12.0-1.33
fixed
suse enterprise desktop 12 SP4
2.12.0-3.3.1
fixed
suse enterprise sap 12
2.10.9-5.15
fixed
suse enterprise sap 12 SP1
2.10.9-8.1
fixed
suse enterprise sap 12 SP2
2.11.0-12.5
fixed
suse enterprise sap 12 SP3
2.12.0-1.33
fixed
suse enterprise sap 12 SP4
2.12.0-3.3.1
fixed
suse enterprise sap 12 SP5
2.12.0-3.3.1
fixed
suse enterprise server 12
2.10.9-5.15
fixed
suse enterprise server 12 SP1
2.10.9-8.1
fixed
suse enterprise server 12 SP2
2.11.0-12.5
fixed
suse enterprise server 12 SP3
2.12.0-1.33
fixed
suse enterprise server 12 SP4
2.12.0-3.3.1
fixed
suse enterprise server 12 SP5
2.12.0-3.3.1
fixed
suse enterprise workstation 12
2.10.9-5.15
fixed
suse enterprise workstation 12 SP1
2.10.9-8.1
fixed
suse enterprise workstation 12 SP2
2.11.0-12.5
fixed
suse enterprise workstation 12 SP3
2.12.0-1.33
fixed
suse enterprise workstation 12 SP4
2.12.0-3.3.1
fixed
suse enterprise workstation 12 SP5
2.12.0-3.3.1
fixed
pidgin
suse enterprise desktop 12
2.10.9-5.15
fixed
suse enterprise desktop 12 SP1
2.10.9-8.1
fixed
suse enterprise desktop 12 SP2
2.11.0-12.5
fixed
suse enterprise desktop 12 SP3
2.12.0-1.33
fixed
suse enterprise desktop 12 SP4
2.12.0-3.3.1
fixed
suse enterprise sap 12
2.10.9-5.15
fixed
suse enterprise sap 12 SP1
2.10.9-8.1
fixed
suse enterprise sap 12 SP2
2.11.0-12.5
fixed
suse enterprise sap 12 SP3
2.12.0-1.33
fixed
suse enterprise sap 12 SP4
2.12.0-3.3.1
fixed
suse enterprise sap 12 SP5
2.12.0-3.3.1
fixed
suse enterprise server 12
2.10.9-5.15
fixed
suse enterprise server 12 SP1
2.10.9-8.1
fixed
suse enterprise server 12 SP2
2.11.0-12.5
fixed
suse enterprise server 12 SP3
2.12.0-1.33
fixed
suse enterprise server 12 SP4
2.12.0-3.3.1
fixed
suse enterprise server 12 SP5
2.12.0-3.3.1
fixed
suse enterprise workstation 12
2.10.9-5.15
fixed
suse enterprise workstation 12 SP1
2.10.9-8.1
fixed
suse enterprise workstation 12 SP2
2.11.0-12.5
fixed
suse enterprise workstation 12 SP3
2.12.0-1.33
fixed
suse enterprise workstation 12 SP4
2.12.0-3.3.1
fixed
suse enterprise workstation 12 SP5
2.12.0-3.3.1
fixed
Red Hat logo
Red Hat Enterprise Linux Releases
Red Hat Product
Release
finch
RHEL 6
0:2.7.9-3.el6
fixed
finch-devel
RHEL 6
0:2.7.9-3.el6
fixed
libpurple
RHEL 6
0:2.7.9-3.el6
fixed
libpurple-devel
RHEL 6
0:2.7.9-3.el6
fixed
libpurple-perl
RHEL 6
0:2.7.9-3.el6
fixed
libpurple-tcl
RHEL 6
0:2.7.9-3.el6
fixed
pidgin
RHEL 6
0:2.7.9-3.el6
fixed
pidgin-devel
RHEL 6
0:2.7.9-3.el6
fixed
pidgin-docs
RHEL 6
0:2.7.9-3.el6
fixed
pidgin-perl
RHEL 6
0:2.7.9-3.el6
fixed
References
http://developer.pidgin.im/viewmtn/revision/diff/5cbe18129b6e7c660bc093f7e5e1414ceca17d04/with/a7c415abba1f5f01f79295337518837f73d99bb7/libpurple/protocols/yahoo/libymsg.c
http://developer.pidgin.im/viewmtn/revision/info/a7c415abba1f5f01f79295337518837f73d99bb7
http://lists.fedoraproject.org/pipermail/package-announce/2011-March/055874.html
http://lists.fedoraproject.org/pipermail/package-announce/2011-March/056309.html
http://secunia.com/advisories/43695
http://secunia.com/advisories/43721
http://secunia.com/advisories/46376
http://slackware.com/security/viewer.php?l=slackware-security&y=2011&m=slackware-security.466884
http://www.pidgin.im/news/security/?id=51
http://www.redhat.com/support/errata/RHSA-2011-0616.html
http://www.redhat.com/support/errata/RHSA-2011-1371.html
http://www.securityfocus.com/bid/46837
http://www.vupen.com/english/advisories/2011/0643
http://www.vupen.com/english/advisories/2011/0661
http://www.vupen.com/english/advisories/2011/0669
http://www.vupen.com/english/advisories/2011/0703
https://bugzilla.redhat.com/show_bug.cgi?id=683031
https://exchange.xforce.ibmcloud.com/vulnerabilities/66055
https://hermes.opensuse.org/messages/13195955
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A18402
http://developer.pidgin.im/viewmtn/revision/diff/5cbe18129b6e7c660bc093f7e5e1414ceca17d04/with/a7c415abba1f5f01f79295337518837f73d99bb7/libpurple/protocols/yahoo/libymsg.c
http://developer.pidgin.im/viewmtn/revision/info/a7c415abba1f5f01f79295337518837f73d99bb7
http://lists.fedoraproject.org/pipermail/package-announce/2011-March/055874.html
http://lists.fedoraproject.org/pipermail/package-announce/2011-March/056309.html
http://secunia.com/advisories/43695
http://secunia.com/advisories/43721
http://secunia.com/advisories/46376
http://slackware.com/security/viewer.php?l=slackware-security&y=2011&m=slackware-security.466884
http://www.pidgin.im/news/security/?id=51
http://www.redhat.com/support/errata/RHSA-2011-0616.html
http://www.redhat.com/support/errata/RHSA-2011-1371.html
http://www.securityfocus.com/bid/46837
http://www.vupen.com/english/advisories/2011/0643
http://www.vupen.com/english/advisories/2011/0661
http://www.vupen.com/english/advisories/2011/0669
http://www.vupen.com/english/advisories/2011/0703
https://bugzilla.redhat.com/show_bug.cgi?id=683031
https://exchange.xforce.ibmcloud.com/vulnerabilities/66055
https://hermes.opensuse.org/messages/13195955
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A18402