CVE-2009-1373
Buffer overflow in the XMPP SOCKS5 bytestream server in Pidgin (formerly Gaim) before 2.5.6...
7.1 HighFix available
Buffer overflow in the XMPP SOCKS5 bytestream server in Pidgin (formerly Gaim) before 2.5.6 allows remote authenticated users to execute arbitrary code via vectors involving an outbound XMPP file transfer. NOTE: some of these details are obtained from third party information.
Exploit likelihood
4.27%Down 4.8 points since Feb 4, 2022
What each source reports
NVD Score used
Buffer overflow in the XMPP SOCKS5 bytestream server in Pidgin (formerly Gaim) before 2.5.6 allows remote authenticated users to execute arbitrary code via vectors involving an outbound XMPP file transfer. NOTE: some of these details are obtained from third party information.
- Record
CVE-2009-1373- CVSS 2.0
- 7.1 High
AV:N/AC:H/Au:S/C:C/I:C/A:C - Weakness
- CWE-119
- Updated
- 2026-11-02
CVE List No score
Buffer overflow in the XMPP SOCKS5 bytestream server in Pidgin (formerly Gaim) before 2.5.6 allows remote authenticated users to execute arbitrary code via vectors involving an outbound XMPP file transfer. NOTE: some of these details are obtained from third party information.
- Record
CVE-2009-1373- Updated
- 2026-11-02
EUVDEUVD-2009-1371 No score
Buffer overflow in the XMPP SOCKS5 bytestream server in Pidgin (formerly Gaim) before 2.5.6 allows remote authenticated users to execute arbitrary code via vectors involving an outbound XMPP file transfer. NOTE: some of these details are obtained from third party information.
- Record
EUVD-2009-1371- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-hfwm-9244-px83 No score
Buffer overflow in the XMPP SOCKS5 bytestream server in Pidgin (formerly Gaim) before 2.5.6...
Buffer overflow in the XMPP SOCKS5 bytestream server in Pidgin (formerly Gaim) before 2.5.6 allows remote authenticated users to execute arbitrary code via vectors involving an outbound XMPP file transfer. NOTE: some of these details are obtained from third party information.
- Record
GHSA-hfwm-9244-px83- Weakness
- CWE-119
- Updated
- 2026-11-02
OSV No score
Buffer overflow in the XMPP SOCKS5 bytestream server in Pidgin (formerly Gaim) before 2.5.6 allows remote authenticated users to execute arbitrary code via vectors involving an outbound XMPP file transfer. NOTE: some of these details are obtained from third party information.
- Record
CVE-2009-1373- Updated
- 2026-11-02
OSVDEBIAN-CVE-2009-1373 No score
Buffer overflow in the XMPP SOCKS5 bytestream server in Pidgin (formerly Gaim) before 2.5.6 allows remote authenticated users to execute arbitrary code via vectors involving an outbound XMPP file transfer. NOTE: some of these details are obtained from third party information.
- Record
DEBIAN-CVE-2009-1373- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
pidginDebian:12 |
before 2.5.6-1 | 2.5.6-1 |
pidginDebian:13 |
before 2.5.6-1 | 2.5.6-1 |
pidginDebian:14 |
before 2.5.6-1 | 2.5.6-1 |
pidginDebian:5.0 From an advisory covering 4 CVEs |
before 2.4.3-4lenny2, plus listed versions 2.4.3-42.4.3-4lenny12.4.3-4lenny1~bpo40+12.4.3-4lenny1~volatile02.4.3-4lenny2~bpo40+1 |
2.4.3-4lenny2 |
pidginRed Hat:enterprise_linux:3::as From an advisory covering 2 CVEs |
before 0:1.5.1-3.el3 | 0:1.5.1-3.el3 |
pidgin-debuginfoRed Hat:enterprise_linux:3::as From an advisory covering 2 CVEs |
before 0:1.5.1-3.el3 | 0:1.5.1-3.el3 |
pidginRed Hat:enterprise_linux:3::desktop From an advisory covering 2 CVEs |
before 0:1.5.1-3.el3 | 0:1.5.1-3.el3 |
pidgin-debuginfoRed Hat:enterprise_linux:3::desktop From an advisory covering 2 CVEs |
before 0:1.5.1-3.el3 | 0:1.5.1-3.el3 |
pidginRed Hat:enterprise_linux:3::es From an advisory covering 2 CVEs |
before 0:1.5.1-3.el3 | 0:1.5.1-3.el3 |
pidgin-debuginfoRed Hat:enterprise_linux:3::es From an advisory covering 2 CVEs |
before 0:1.5.1-3.el3 | 0:1.5.1-3.el3 |
Show 54 moreShow less
| Package | Affected | Fixed |
|---|---|---|
pidginRed Hat:enterprise_linux:3::ws From an advisory covering 2 CVEs |
before 0:1.5.1-3.el3 | 0:1.5.1-3.el3 |
pidgin-debuginfoRed Hat:enterprise_linux:3::ws From an advisory covering 2 CVEs |
before 0:1.5.1-3.el3 | 0:1.5.1-3.el3 |
finchRed Hat:enterprise_linux:4::as From an advisory covering 4 CVEs |
before 0:2.5.5-2.el4 | 0:2.5.5-2.el4 |
finch-develRed Hat:enterprise_linux:4::as From an advisory covering 4 CVEs |
before 0:2.5.5-2.el4 | 0:2.5.5-2.el4 |
libpurpleRed Hat:enterprise_linux:4::as From an advisory covering 4 CVEs |
before 0:2.5.5-2.el4 | 0:2.5.5-2.el4 |
libpurple-develRed Hat:enterprise_linux:4::as From an advisory covering 4 CVEs |
before 0:2.5.5-2.el4 | 0:2.5.5-2.el4 |
libpurple-perlRed Hat:enterprise_linux:4::as From an advisory covering 4 CVEs |
before 0:2.5.5-2.el4 | 0:2.5.5-2.el4 |
libpurple-tclRed Hat:enterprise_linux:4::as From an advisory covering 4 CVEs |
before 0:2.5.5-2.el4 | 0:2.5.5-2.el4 |
pidginRed Hat:enterprise_linux:4::as From an advisory covering 4 CVEs |
before 0:2.5.5-2.el4 | 0:2.5.5-2.el4 |
pidgin-debuginfoRed Hat:enterprise_linux:4::as From an advisory covering 4 CVEs |
before 0:2.5.5-2.el4 | 0:2.5.5-2.el4 |
pidgin-develRed Hat:enterprise_linux:4::as From an advisory covering 4 CVEs |
before 0:2.5.5-2.el4 | 0:2.5.5-2.el4 |
pidgin-perlRed Hat:enterprise_linux:4::as From an advisory covering 4 CVEs |
before 0:2.5.5-2.el4 | 0:2.5.5-2.el4 |
finchRed Hat:enterprise_linux:4::desktop From an advisory covering 4 CVEs |
before 0:2.5.5-2.el4 | 0:2.5.5-2.el4 |
finch-develRed Hat:enterprise_linux:4::desktop From an advisory covering 4 CVEs |
before 0:2.5.5-2.el4 | 0:2.5.5-2.el4 |
libpurpleRed Hat:enterprise_linux:4::desktop From an advisory covering 4 CVEs |
before 0:2.5.5-2.el4 | 0:2.5.5-2.el4 |
libpurple-develRed Hat:enterprise_linux:4::desktop From an advisory covering 4 CVEs |
before 0:2.5.5-2.el4 | 0:2.5.5-2.el4 |
libpurple-perlRed Hat:enterprise_linux:4::desktop From an advisory covering 4 CVEs |
before 0:2.5.5-2.el4 | 0:2.5.5-2.el4 |
libpurple-tclRed Hat:enterprise_linux:4::desktop From an advisory covering 4 CVEs |
before 0:2.5.5-2.el4 | 0:2.5.5-2.el4 |
pidginRed Hat:enterprise_linux:4::desktop From an advisory covering 4 CVEs |
before 0:2.5.5-2.el4 | 0:2.5.5-2.el4 |
pidgin-debuginfoRed Hat:enterprise_linux:4::desktop From an advisory covering 4 CVEs |
before 0:2.5.5-2.el4 | 0:2.5.5-2.el4 |
pidgin-develRed Hat:enterprise_linux:4::desktop From an advisory covering 4 CVEs |
before 0:2.5.5-2.el4 | 0:2.5.5-2.el4 |
pidgin-perlRed Hat:enterprise_linux:4::desktop From an advisory covering 4 CVEs |
before 0:2.5.5-2.el4 | 0:2.5.5-2.el4 |
finchRed Hat:enterprise_linux:4::es From an advisory covering 4 CVEs |
before 0:2.5.5-2.el4 | 0:2.5.5-2.el4 |
finch-develRed Hat:enterprise_linux:4::es From an advisory covering 4 CVEs |
before 0:2.5.5-2.el4 | 0:2.5.5-2.el4 |
libpurpleRed Hat:enterprise_linux:4::es From an advisory covering 4 CVEs |
before 0:2.5.5-2.el4 | 0:2.5.5-2.el4 |
libpurple-develRed Hat:enterprise_linux:4::es From an advisory covering 4 CVEs |
before 0:2.5.5-2.el4 | 0:2.5.5-2.el4 |
libpurple-perlRed Hat:enterprise_linux:4::es From an advisory covering 4 CVEs |
before 0:2.5.5-2.el4 | 0:2.5.5-2.el4 |
libpurple-tclRed Hat:enterprise_linux:4::es From an advisory covering 4 CVEs |
before 0:2.5.5-2.el4 | 0:2.5.5-2.el4 |
pidginRed Hat:enterprise_linux:4::es From an advisory covering 4 CVEs |
before 0:2.5.5-2.el4 | 0:2.5.5-2.el4 |
pidgin-debuginfoRed Hat:enterprise_linux:4::es From an advisory covering 4 CVEs |
before 0:2.5.5-2.el4 | 0:2.5.5-2.el4 |
pidgin-develRed Hat:enterprise_linux:4::es From an advisory covering 4 CVEs |
before 0:2.5.5-2.el4 | 0:2.5.5-2.el4 |
pidgin-perlRed Hat:enterprise_linux:4::es From an advisory covering 4 CVEs |
before 0:2.5.5-2.el4 | 0:2.5.5-2.el4 |
finchRed Hat:enterprise_linux:4::ws From an advisory covering 4 CVEs |
before 0:2.5.5-2.el4 | 0:2.5.5-2.el4 |
finch-develRed Hat:enterprise_linux:4::ws From an advisory covering 4 CVEs |
before 0:2.5.5-2.el4 | 0:2.5.5-2.el4 |
libpurpleRed Hat:enterprise_linux:4::ws From an advisory covering 4 CVEs |
before 0:2.5.5-2.el4 | 0:2.5.5-2.el4 |
libpurple-develRed Hat:enterprise_linux:4::ws From an advisory covering 4 CVEs |
before 0:2.5.5-2.el4 | 0:2.5.5-2.el4 |
libpurple-perlRed Hat:enterprise_linux:4::ws From an advisory covering 4 CVEs |
before 0:2.5.5-2.el4 | 0:2.5.5-2.el4 |
libpurple-tclRed Hat:enterprise_linux:4::ws From an advisory covering 4 CVEs |
before 0:2.5.5-2.el4 | 0:2.5.5-2.el4 |
pidginRed Hat:enterprise_linux:4::ws From an advisory covering 4 CVEs |
before 0:2.5.5-2.el4 | 0:2.5.5-2.el4 |
pidgin-debuginfoRed Hat:enterprise_linux:4::ws From an advisory covering 4 CVEs |
before 0:2.5.5-2.el4 | 0:2.5.5-2.el4 |
pidgin-develRed Hat:enterprise_linux:4::ws From an advisory covering 4 CVEs |
before 0:2.5.5-2.el4 | 0:2.5.5-2.el4 |
pidgin-perlRed Hat:enterprise_linux:4::ws From an advisory covering 4 CVEs |
before 0:2.5.5-2.el4 | 0:2.5.5-2.el4 |
finch-develRed Hat:enterprise_linux:5::client_workstation From an advisory covering 4 CVEs |
before 0:2.5.5-3.el5 | 0:2.5.5-3.el5 |
libpurple-develRed Hat:enterprise_linux:5::client_workstation From an advisory covering 4 CVEs |
before 0:2.5.5-3.el5 | 0:2.5.5-3.el5 |
pidginRed Hat:enterprise_linux:5::client_workstation From an advisory covering 4 CVEs |
before 0:2.5.5-3.el5 | 0:2.5.5-3.el5 |
pidgin-debuginfoRed Hat:enterprise_linux:5::client_workstation From an advisory covering 4 CVEs |
before 0:2.5.5-3.el5 | 0:2.5.5-3.el5 |
pidgin-develRed Hat:enterprise_linux:5::client_workstation From an advisory covering 4 CVEs |
before 0:2.5.5-3.el5 | 0:2.5.5-3.el5 |
finchRed Hat:enterprise_linux:5::client From an advisory covering 4 CVEs |
before 0:2.5.5-3.el5 | 0:2.5.5-3.el5 |
libpurpleRed Hat:enterprise_linux:5::client From an advisory covering 4 CVEs |
before 0:2.5.5-3.el5 | 0:2.5.5-3.el5 |
libpurple-perlRed Hat:enterprise_linux:5::client From an advisory covering 4 CVEs |
before 0:2.5.5-3.el5 | 0:2.5.5-3.el5 |
libpurple-tclRed Hat:enterprise_linux:5::client From an advisory covering 4 CVEs |
before 0:2.5.5-3.el5 | 0:2.5.5-3.el5 |
pidginRed Hat:enterprise_linux:5::client From an advisory covering 4 CVEs |
before 0:2.5.5-3.el5 | 0:2.5.5-3.el5 |
pidgin-debuginfoRed Hat:enterprise_linux:5::client From an advisory covering 4 CVEs |
before 0:2.5.5-3.el5 | 0:2.5.5-3.el5 |
pidgin-perlRed Hat:enterprise_linux:5::client From an advisory covering 4 CVEs |
before 0:2.5.5-3.el5 | 0:2.5.5-3.el5 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2009-1373 is a high vulnerability (CVSS 7.1) in Pidgin, published May 22, 2009. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 4.27%, the 91st percentile. Fixed in pidgin 2.5.6-1.
References
redhat.com/archives/fedora-package-announce/2009-June/msg00075.html
ubuntu.com/usn/USN-781-2
gentoo.org/security/en/glsa/glsa-200905-07.xml
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9005
Show 41 moreShow less
securityfocus.com/bid/35067
secunia.com/advisories/35329
debian.org/security/2009/dsa-1805
mandriva.com/security/advisories?name=MDVSA-2009:140
bugzilla.redhat.com/show_bug.cgi?id=500488
exchange.xforce.ibmcloud.com/vulnerabilities/50682
pidgin.im/news/security?id=29
vupen.com/english/advisories/2009/1396
nvd.nist.gov/vuln/detail/CVE-2009-1373
github.com/advisories/GHSA-hfwm-9244-px83
security-tracker.debian.org/tracker/CVE-2009-1373
access.redhat.com/errata/RHSA-2009:1059
security.access.redhat.com/data/csaf/v2/advisories/2009/rhsa-2009_1059.json
cve.org/CVERecord?id=CVE-2009-1373