Bug 453736 (CVE-2008-2955)

Summary: CVE-2008-2955 pidgin: remote DoS via MSN message with crafted file name
Product: [Other] Security Response Reporter: Tomas Hoger <thoger>
Component: vulnerabilityAssignee: Red Hat Product Security <security-response-team>
Status: CLOSED ERRATA QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: eblanton, kreilly, lschiere+bugs, mark, redhat-bugzilla, stu, wtogami
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
URL: http://nvd.nist.gov/nvd.cfm?cvename=CVE-2008-2955
Whiteboard:
Fixed In Version: Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2012-06-20 15:28:10 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 472585, 472586, 472587, 472588, 833957    
Bug Blocks:    

Description Tomas Hoger 2008-07-02 09:20:09 UTC 
Common Vulnerabilities and Exposures assigned an identifier CVE-2008-2955 to the following vulnerability:

Pidgin 2.4.1 allows remote attackers to cause a denial of service
(crash) via a long filename that contains certain characters, as
demonstrated using an MSN message that triggers the crash in the
msn_slplink_process_msg function.

References:
http://www.securityfocus.com/archive/1/archive/1/493682/100/0/threaded
http://secunia.com/advisories/30881
http://www.frsirt.com/english/advisories/2008/1947
Comment 1 Robert Buchholz 2008-07-30 18:38:43 UTC 
upstream bug:
http://developer.pidgin.im/ticket/6246
Comment 2 Tomas Hoger 2008-08-27 19:51:42 UTC 
Upstream advisory:
  http://www.pidgin.im/news/security/?id=26

Fixed upstream in: 2.4.3