Skip to Content.
Sympa Menu

sm-security - [SM-Security] gaim: two vulnerabilities

sm-security AT lists.ibiblio.org

Subject: Security bugs are reported here via bugzilla

List archive

Chronological Thread  
  • From: Thomas Houssin <Thomas.Houssin AT gmail.com>
  • To: sm-security AT lists.ibiblio.org
  • Subject: [SM-Security] gaim: two vulnerabilities
  • Date: Sun, 12 Jun 2005 14:58:08 +0200

Synopsis
========
Certain malformed MSN messages can cause gaim to crash. Moreother, a
remote denial of service on Yahoo! was reported.

Background
==========
gaim is an instant messanger client for several protocols.

Description
===========
CAN-2005-1269
Remove denial of service when being offered files with names containing
non-ASCII characters.

CAN-2005-1934
Remote attackers can cause a denial of service (crash) via a malformed
MSN message that leads to a memory allocation of a large size, possibly
due to an integer signedness error.

Affected packages
=================
gaim in all grimoires is affected.
This is now fixed in devel, test, stable-rc and stable grimoires (gaim
updated to 1.3.1).

Resolution
==========
All gaim users should upgrade to the latest available version:
#scribe update
#cast -c gaim

--
Thomas Houssin

Security Team Lead : Source Mage GNU/Linux http://www.sourcemage.org
Key fingerprint = 3CB8 3FC4 840D B272 E623 BCB8 54DB F4E3 4240 4C36
http://pgp.mit.edu:11371/pks/lookup?op=get&search=0x42404C36

Attachment: signature.asc
Description: OpenPGP digital signature



  • [SM-Security] gaim: two vulnerabilities, Thomas Houssin, 06/12/2005

Archive powered by MHonArc 2.6.24.

Top of Page