Every CVE Search/ Get API key

CVE-2009-1376

Multiple integer overflows in the msn_slplink_process_msg functions in the MSN protocol handler...

9.3 HighPublic exploitFix available

Multiple integer overflows in the msn_slplink_process_msg functions in the MSN protocol handler in (1) libpurple/protocols/msn/slplink.c and (2) libpurple/protocols/msnp9/slplink.c in Pidgin (formerly Gaim) before 2.5.6 on 32-bit platforms allow remote attackers to execute arbitrary code via a malformed SLP message with a crafted offset value, leading to buffer overflows. NOTE: this issue exists because of an incomplete fix for CVE-2008-2927.

Exploit likelihood

13.3%Up 1.0 points since Feb 4, 2022
90%50%10%1%

What each source reports

NVD Score used 9.3

Multiple integer overflows in the msn_slplink_process_msg functions in the MSN protocol handler in (1) libpurple/protocols/msn/slplink.c and (2) libpurple/protocols/msnp9/slplink.c in Pidgin (formerly Gaim) before 2.5.6 on 32-bit platforms allow remote attackers to execute arbitrary code via a malformed SLP message with a crafted offset value, leading to buffer overflows. NOTE: this issue exists because of an incomplete fix for CVE-2008-2927.

Record
CVE-2009-1376
CVSS 2.0
9.3 HighAV:N/AC:M/Au:N/C:C/I:C/A:C
Weakness
CWE-189
Updated
2026-11-02
CVE List No score

Multiple integer overflows in the msn_slplink_process_msg functions in the MSN protocol handler in (1) libpurple/protocols/msn/slplink.c and (2) libpurple/protocols/msnp9/slplink.c in Pidgin (formerly Gaim) before 2.5.6 on 32-bit platforms allow remote attackers to execute arbitrary code via a malformed SLP message with a crafted offset value, leading to buffer overflows. NOTE: this issue exists because of an incomplete fix for CVE-2008-2927.

Record
CVE-2009-1376
Updated
2026-11-02
EUVDEUVD-2009-1374 No score

Multiple integer overflows in the msn_slplink_process_msg functions in the MSN protocol handler in (1) libpurple/protocols/msn/slplink.c and (2) libpurple/protocols/msnp9/slplink.c in Pidgin (formerly Gaim) before 2.5.6 on 32-bit platforms allow remote attackers to execute arbitrary code via a malformed SLP message with a crafted offset value, leading to buffer overflows. NOTE: this issue exists because of an incomplete fix for CVE-2008-2927.

Record
EUVD-2009-1374
Updated
2026-11-03
GitHub AdvisoriesGHSA-p33h-j5pj-5f6r No score

Multiple integer overflows in the msn_slplink_process_msg functions in the MSN protocol handler...

Multiple integer overflows in the msn_slplink_process_msg functions in the MSN protocol handler in (1) libpurple/protocols/msn/slplink.c and (2) libpurple/protocols/msnp9/slplink.c in Pidgin (formerly Gaim) before 2.5.6 on 32-bit platforms allow remote attackers to execute arbitrary code via a malformed SLP message with a crafted offset value, leading to buffer overflows. NOTE: this issue exists because of an incomplete fix for CVE-2008-2927.

Record
GHSA-p33h-j5pj-5f6r
Updated
2026-11-02
OSV No score

Multiple integer overflows in the msn_slplink_process_msg functions in the MSN protocol handler in (1) libpurple/protocols/msn/slplink.c and (2) libpurple/protocols/msnp9/slplink.c in Pidgin (formerly Gaim) before 2.5.6 on 32-bit platforms allow remote attackers to execute arbitrary code via a malformed SLP message with a crafted offset value, leading to buffer overflows. NOTE: this issue exists because of an incomplete fix for CVE-2008-2927.

Record
CVE-2009-1376
Updated
2026-11-02
OSVDEBIAN-CVE-2009-1376 No score

Multiple integer overflows in the msn_slplink_process_msg functions in the MSN protocol handler in (1) libpurple/protocols/msn/slplink.c and (2) libpurple/protocols/msnp9/slplink.c in Pidgin (formerly Gaim) before 2.5.6 on 32-bit platforms allow remote attackers to execute arbitrary code via a malformed SLP message with a crafted offset value, leading to buffer overflows. NOTE: this issue exists because of an incomplete fix for CVE-2008-2927.

Record
DEBIAN-CVE-2009-1376
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
pidgin
Debian:12
 before 2.5.6-1
2.5.6-1
pidgin
Debian:13
 before 2.5.6-1
2.5.6-1
pidgin
Debian:14
 before 2.5.6-1
2.5.6-1
pidgin
Debian:5.0
From an advisory covering 4 CVEs
 before 2.4.3-4lenny2, plus listed versions
2.4.3-42.4.3-4lenny12.4.3-4lenny1~bpo40+12.4.3-4lenny1~volatile02.4.3-4lenny2~bpo40+1
2.4.3-4lenny2
pidgin
Red Hat:enterprise_linux:3::as
From an advisory covering 2 CVEs
 before 0:1.5.1-3.el3
0:1.5.1-3.el3
pidgin-debuginfo
Red Hat:enterprise_linux:3::as
From an advisory covering 2 CVEs
 before 0:1.5.1-3.el3
0:1.5.1-3.el3
pidgin
Red Hat:enterprise_linux:3::desktop
From an advisory covering 2 CVEs
 before 0:1.5.1-3.el3
0:1.5.1-3.el3
pidgin-debuginfo
Red Hat:enterprise_linux:3::desktop
From an advisory covering 2 CVEs
 before 0:1.5.1-3.el3
0:1.5.1-3.el3
pidgin
Red Hat:enterprise_linux:3::es
From an advisory covering 2 CVEs
 before 0:1.5.1-3.el3
0:1.5.1-3.el3
pidgin-debuginfo
Red Hat:enterprise_linux:3::es
From an advisory covering 2 CVEs
 before 0:1.5.1-3.el3
0:1.5.1-3.el3
Show 54 moreShow less
Affected packages
PackageAffectedFixed
pidgin
Red Hat:enterprise_linux:3::ws
From an advisory covering 2 CVEs
 before 0:1.5.1-3.el3
0:1.5.1-3.el3
pidgin-debuginfo
Red Hat:enterprise_linux:3::ws
From an advisory covering 2 CVEs
 before 0:1.5.1-3.el3
0:1.5.1-3.el3
finch
Red Hat:enterprise_linux:4::as
From an advisory covering 4 CVEs
 before 0:2.5.5-2.el4
0:2.5.5-2.el4
finch-devel
Red Hat:enterprise_linux:4::as
From an advisory covering 4 CVEs
 before 0:2.5.5-2.el4
0:2.5.5-2.el4
libpurple
Red Hat:enterprise_linux:4::as
From an advisory covering 4 CVEs
 before 0:2.5.5-2.el4
0:2.5.5-2.el4
libpurple-devel
Red Hat:enterprise_linux:4::as
From an advisory covering 4 CVEs
 before 0:2.5.5-2.el4
0:2.5.5-2.el4
libpurple-perl
Red Hat:enterprise_linux:4::as
From an advisory covering 4 CVEs
 before 0:2.5.5-2.el4
0:2.5.5-2.el4
libpurple-tcl
Red Hat:enterprise_linux:4::as
From an advisory covering 4 CVEs
 before 0:2.5.5-2.el4
0:2.5.5-2.el4
pidgin
Red Hat:enterprise_linux:4::as
From an advisory covering 4 CVEs
 before 0:2.5.5-2.el4
0:2.5.5-2.el4
pidgin-debuginfo
Red Hat:enterprise_linux:4::as
From an advisory covering 4 CVEs
 before 0:2.5.5-2.el4
0:2.5.5-2.el4
pidgin-devel
Red Hat:enterprise_linux:4::as
From an advisory covering 4 CVEs
 before 0:2.5.5-2.el4
0:2.5.5-2.el4
pidgin-perl
Red Hat:enterprise_linux:4::as
From an advisory covering 4 CVEs
 before 0:2.5.5-2.el4
0:2.5.5-2.el4
finch
Red Hat:enterprise_linux:4::desktop
From an advisory covering 4 CVEs
 before 0:2.5.5-2.el4
0:2.5.5-2.el4
finch-devel
Red Hat:enterprise_linux:4::desktop
From an advisory covering 4 CVEs
 before 0:2.5.5-2.el4
0:2.5.5-2.el4
libpurple
Red Hat:enterprise_linux:4::desktop
From an advisory covering 4 CVEs
 before 0:2.5.5-2.el4
0:2.5.5-2.el4
libpurple-devel
Red Hat:enterprise_linux:4::desktop
From an advisory covering 4 CVEs
 before 0:2.5.5-2.el4
0:2.5.5-2.el4
libpurple-perl
Red Hat:enterprise_linux:4::desktop
From an advisory covering 4 CVEs
 before 0:2.5.5-2.el4
0:2.5.5-2.el4
libpurple-tcl
Red Hat:enterprise_linux:4::desktop
From an advisory covering 4 CVEs
 before 0:2.5.5-2.el4
0:2.5.5-2.el4
pidgin
Red Hat:enterprise_linux:4::desktop
From an advisory covering 4 CVEs
 before 0:2.5.5-2.el4
0:2.5.5-2.el4
pidgin-debuginfo
Red Hat:enterprise_linux:4::desktop
From an advisory covering 4 CVEs
 before 0:2.5.5-2.el4
0:2.5.5-2.el4
pidgin-devel
Red Hat:enterprise_linux:4::desktop
From an advisory covering 4 CVEs
 before 0:2.5.5-2.el4
0:2.5.5-2.el4
pidgin-perl
Red Hat:enterprise_linux:4::desktop
From an advisory covering 4 CVEs
 before 0:2.5.5-2.el4
0:2.5.5-2.el4
finch
Red Hat:enterprise_linux:4::es
From an advisory covering 4 CVEs
 before 0:2.5.5-2.el4
0:2.5.5-2.el4
finch-devel
Red Hat:enterprise_linux:4::es
From an advisory covering 4 CVEs
 before 0:2.5.5-2.el4
0:2.5.5-2.el4
libpurple
Red Hat:enterprise_linux:4::es
From an advisory covering 4 CVEs
 before 0:2.5.5-2.el4
0:2.5.5-2.el4
libpurple-devel
Red Hat:enterprise_linux:4::es
From an advisory covering 4 CVEs
 before 0:2.5.5-2.el4
0:2.5.5-2.el4
libpurple-perl
Red Hat:enterprise_linux:4::es
From an advisory covering 4 CVEs
 before 0:2.5.5-2.el4
0:2.5.5-2.el4
libpurple-tcl
Red Hat:enterprise_linux:4::es
From an advisory covering 4 CVEs
 before 0:2.5.5-2.el4
0:2.5.5-2.el4
pidgin
Red Hat:enterprise_linux:4::es
From an advisory covering 4 CVEs
 before 0:2.5.5-2.el4
0:2.5.5-2.el4
pidgin-debuginfo
Red Hat:enterprise_linux:4::es
From an advisory covering 4 CVEs
 before 0:2.5.5-2.el4
0:2.5.5-2.el4
pidgin-devel
Red Hat:enterprise_linux:4::es
From an advisory covering 4 CVEs
 before 0:2.5.5-2.el4
0:2.5.5-2.el4
pidgin-perl
Red Hat:enterprise_linux:4::es
From an advisory covering 4 CVEs
 before 0:2.5.5-2.el4
0:2.5.5-2.el4
finch
Red Hat:enterprise_linux:4::ws
From an advisory covering 4 CVEs
 before 0:2.5.5-2.el4
0:2.5.5-2.el4
finch-devel
Red Hat:enterprise_linux:4::ws
From an advisory covering 4 CVEs
 before 0:2.5.5-2.el4
0:2.5.5-2.el4
libpurple
Red Hat:enterprise_linux:4::ws
From an advisory covering 4 CVEs
 before 0:2.5.5-2.el4
0:2.5.5-2.el4
libpurple-devel
Red Hat:enterprise_linux:4::ws
From an advisory covering 4 CVEs
 before 0:2.5.5-2.el4
0:2.5.5-2.el4
libpurple-perl
Red Hat:enterprise_linux:4::ws
From an advisory covering 4 CVEs
 before 0:2.5.5-2.el4
0:2.5.5-2.el4
libpurple-tcl
Red Hat:enterprise_linux:4::ws
From an advisory covering 4 CVEs
 before 0:2.5.5-2.el4
0:2.5.5-2.el4
pidgin
Red Hat:enterprise_linux:4::ws
From an advisory covering 4 CVEs
 before 0:2.5.5-2.el4
0:2.5.5-2.el4
pidgin-debuginfo
Red Hat:enterprise_linux:4::ws
From an advisory covering 4 CVEs
 before 0:2.5.5-2.el4
0:2.5.5-2.el4
pidgin-devel
Red Hat:enterprise_linux:4::ws
From an advisory covering 4 CVEs
 before 0:2.5.5-2.el4
0:2.5.5-2.el4
pidgin-perl
Red Hat:enterprise_linux:4::ws
From an advisory covering 4 CVEs
 before 0:2.5.5-2.el4
0:2.5.5-2.el4
finch-devel
Red Hat:enterprise_linux:5::client_workstation
From an advisory covering 4 CVEs
 before 0:2.5.5-3.el5
0:2.5.5-3.el5
libpurple-devel
Red Hat:enterprise_linux:5::client_workstation
From an advisory covering 4 CVEs
 before 0:2.5.5-3.el5
0:2.5.5-3.el5
pidgin
Red Hat:enterprise_linux:5::client_workstation
From an advisory covering 4 CVEs
 before 0:2.5.5-3.el5
0:2.5.5-3.el5
pidgin-debuginfo
Red Hat:enterprise_linux:5::client_workstation
From an advisory covering 4 CVEs
 before 0:2.5.5-3.el5
0:2.5.5-3.el5
pidgin-devel
Red Hat:enterprise_linux:5::client_workstation
From an advisory covering 4 CVEs
 before 0:2.5.5-3.el5
0:2.5.5-3.el5
finch
Red Hat:enterprise_linux:5::client
From an advisory covering 4 CVEs
 before 0:2.5.5-3.el5
0:2.5.5-3.el5
libpurple
Red Hat:enterprise_linux:5::client
From an advisory covering 4 CVEs
 before 0:2.5.5-3.el5
0:2.5.5-3.el5
libpurple-perl
Red Hat:enterprise_linux:5::client
From an advisory covering 4 CVEs
 before 0:2.5.5-3.el5
0:2.5.5-3.el5
libpurple-tcl
Red Hat:enterprise_linux:5::client
From an advisory covering 4 CVEs
 before 0:2.5.5-3.el5
0:2.5.5-3.el5
pidgin
Red Hat:enterprise_linux:5::client
From an advisory covering 4 CVEs
 before 0:2.5.5-3.el5
0:2.5.5-3.el5
pidgin-debuginfo
Red Hat:enterprise_linux:5::client
From an advisory covering 4 CVEs
 before 0:2.5.5-3.el5
0:2.5.5-3.el5
pidgin-perl
Red Hat:enterprise_linux:5::client
From an advisory covering 4 CVEs
 before 0:2.5.5-3.el5
0:2.5.5-3.el5

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
SourceLinkDate
Exploit-DBPidgin MSN 2.5.8 - Remote Code Execution2009-09-09

History

History
RecordedChangedSources
affected, facts
aliasesEUVD
first indexedCVE List, Exploit-DB, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2009-1376 is a high vulnerability (CVSS 9.3) in Pidgin, published May 22, 2009. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 13.3%, the 96th percentile. Fixed in pidgin 2.5.6-1.

References

Show 42 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open