CVE-2011-1091

Publication date 14 March 2011

Last updated 24 July 2024

libymsg.c in the Yahoo! protocol plugin in libpurple in Pidgin 2.6.0 through 2.7.10 allows (1) remote authenticated users to cause a denial of service (NULL pointer dereference and application crash) via a malformed YMSG notification packet, and allows (2) remote Yahoo! servers to cause a denial of service (NULL pointer dereference and application crash) via a malformed YMSG SMS message.

Read the notes from the security team

Status

Show unmaintained releases

Package	Ubuntu Release	Status
pidgin	11.10 oneiric	Fixed 1:2.7.11-1ubuntu1
	11.04 natty	Fixed 1:2.7.11-1ubuntu1
	10.10 maverick	Fixed 1:2.7.3-1ubuntu3.3
	10.04 LTS lucid	Fixed 1:2.6.6-1ubuntu4.4
	9.10 karmic	Ignored end of life
	8.04 LTS hardy	Ignored end of life
	6.06 LTS dapper	Not in release

Notes

mdeslaur

just a DoS

Patch details

For informational purposes only. We recommend not to cherry-pick updates. How can I get the fixes?

Package	Patch details
pidgin	Upstream: http://developer.pidgin.im/viewmtn/revision/info/a7c415abba1f5f01f79295337518837f73d99bb7 Vendor: https://rhn.redhat.com/errata/RHSA-2011-1371.html

References

Related Ubuntu Security Notices (USN)