Every CVE Search/ Get API key

CVE-2009-2694

The msn_slplink_process_msg function in libpurple/protocols/msn/slplink.c in libpurple, as used...

10.0 HighPublic exploitFix available

The msn_slplink_process_msg function in libpurple/protocols/msn/slplink.c in libpurple, as used in Pidgin (formerly Gaim) before 2.5.9 and Adium 1.3.5 and earlier, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) by sending multiple crafted SLP (aka MSNSLP) messages to trigger an overwrite of an arbitrary memory location. NOTE: this issue reportedly exists because of an incomplete fix for CVE-2009-1376.

Exploit likelihood

20.3%Up 12.1 points since Feb 4, 2022
90%50%10%1%

What each source reports

NVD Score used 10.0

The msn_slplink_process_msg function in libpurple/protocols/msn/slplink.c in libpurple, as used in Pidgin (formerly Gaim) before 2.5.9 and Adium 1.3.5 and earlier, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) by sending multiple crafted SLP (aka MSNSLP) messages to trigger an overwrite of an arbitrary memory location. NOTE: this issue reportedly exists because of an incomplete fix for CVE-2009-1376.

Record
CVE-2009-2694
CVSS 2.0
10.0 HighAV:N/AC:L/Au:N/C:C/I:C/A:C
Weakness
CWE-399
Updated
2026-11-02
CVE List No score

The msn_slplink_process_msg function in libpurple/protocols/msn/slplink.c in libpurple, as used in Pidgin (formerly Gaim) before 2.5.9 and Adium 1.3.5 and earlier, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) by sending multiple crafted SLP (aka MSNSLP) messages to trigger an overwrite of an arbitrary memory location. NOTE: this issue reportedly exists because of an incomplete fix for CVE-2009-1376.

Record
CVE-2009-2694
Updated
2026-11-02
EUVDEUVD-2009-2686 No score

The msn_slplink_process_msg function in libpurple/protocols/msn/slplink.c in libpurple, as used in Pidgin (formerly Gaim) before 2.5.9 and Adium 1.3.5 and earlier, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) by sending multiple crafted SLP (aka MSNSLP) messages to trigger an overwrite of an arbitrary memory location. NOTE: this issue reportedly exists because of an incomplete fix for CVE-2009-1376.

Record
EUVD-2009-2686
Updated
2026-11-03
GitHub AdvisoriesGHSA-gg6v-c4q4-582f No score

The msn_slplink_process_msg function in libpurple/protocols/msn/slplink.c in libpurple, as used...

The msn_slplink_process_msg function in libpurple/protocols/msn/slplink.c in libpurple, as used in Pidgin (formerly Gaim) before 2.5.9 and Adium 1.3.5 and earlier, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) by sending multiple crafted SLP (aka MSNSLP) messages to trigger an overwrite of an arbitrary memory location. NOTE: this issue reportedly exists because of an incomplete fix for CVE-2009-1376.

Record
GHSA-gg6v-c4q4-582f
Updated
2026-11-02
OSV No score

The msn_slplink_process_msg function in libpurple/protocols/msn/slplink.c in libpurple, as used in Pidgin (formerly Gaim) before 2.5.9 and Adium 1.3.5 and earlier, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) by sending multiple crafted SLP (aka MSNSLP) messages to trigger an overwrite of an arbitrary memory location. NOTE: this issue reportedly exists because of an incomplete fix for CVE-2009-1376.

Record
CVE-2009-2694
Updated
2026-11-02
OSVDEBIAN-CVE-2009-2694 No score

The msn_slplink_process_msg function in libpurple/protocols/msn/slplink.c in libpurple, as used in Pidgin (formerly Gaim) before 2.5.9 and Adium 1.3.5 and earlier, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) by sending multiple crafted SLP (aka MSNSLP) messages to trigger an overwrite of an arbitrary memory location. NOTE: this issue reportedly exists because of an incomplete fix for CVE-2009-1376.

Record
DEBIAN-CVE-2009-2694
Updated
2026-11-02
OSVopenSUSE-SU-2024:10432-1 No score

finch-2.11.0-4.1 on GA media

These are all security issues fixed in the finch-2.11.0-4.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:10432-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
pidgin
Debian:12
 before 2.5.9-1
2.5.9-1
pidgin
Debian:13
 before 2.5.9-1
2.5.9-1
pidgin
Debian:14
 before 2.5.9-1
2.5.9-1
pidgin
Debian:5.0
 before 2.4.3-4lenny3, plus listed versions
2.4.3-42.4.3-4lenny12.4.3-4lenny1~bpo40+12.4.3-4lenny1~volatile02.4.3-4lenny22.4.3-4lenny2~bpo40+12.4.3-4lenny3~bpo40+1
2.4.3-4lenny3
pidgin
Red Hat:enterprise_linux:3::as
 before 0:1.5.1-4.el3
0:1.5.1-4.el3
pidgin-debuginfo
Red Hat:enterprise_linux:3::as
 before 0:1.5.1-4.el3
0:1.5.1-4.el3
pidgin
Red Hat:enterprise_linux:3::desktop
 before 0:1.5.1-4.el3
0:1.5.1-4.el3
pidgin-debuginfo
Red Hat:enterprise_linux:3::desktop
 before 0:1.5.1-4.el3
0:1.5.1-4.el3
pidgin
Red Hat:enterprise_linux:3::es
 before 0:1.5.1-4.el3
0:1.5.1-4.el3
pidgin-debuginfo
Red Hat:enterprise_linux:3::es
 before 0:1.5.1-4.el3
0:1.5.1-4.el3
Show 64 moreShow less
Affected packages
PackageAffectedFixed
pidgin
Red Hat:enterprise_linux:3::ws
 before 0:1.5.1-4.el3
0:1.5.1-4.el3
pidgin-debuginfo
Red Hat:enterprise_linux:3::ws
 before 0:1.5.1-4.el3
0:1.5.1-4.el3
finch
Red Hat:enterprise_linux:4::as
 before 0:2.5.9-1.el4
0:2.5.9-1.el4
finch-devel
Red Hat:enterprise_linux:4::as
 before 0:2.5.9-1.el4
0:2.5.9-1.el4
libpurple
Red Hat:enterprise_linux:4::as
 before 0:2.5.9-1.el4
0:2.5.9-1.el4
libpurple-devel
Red Hat:enterprise_linux:4::as
 before 0:2.5.9-1.el4
0:2.5.9-1.el4
libpurple-perl
Red Hat:enterprise_linux:4::as
 before 0:2.5.9-1.el4
0:2.5.9-1.el4
libpurple-tcl
Red Hat:enterprise_linux:4::as
 before 0:2.5.9-1.el4
0:2.5.9-1.el4
pidgin
Red Hat:enterprise_linux:4::as
 before 0:2.5.9-1.el4
0:2.5.9-1.el4
pidgin-debuginfo
Red Hat:enterprise_linux:4::as
 before 0:2.5.9-1.el4
0:2.5.9-1.el4
pidgin-devel
Red Hat:enterprise_linux:4::as
 before 0:2.5.9-1.el4
0:2.5.9-1.el4
pidgin-perl
Red Hat:enterprise_linux:4::as
 before 0:2.5.9-1.el4
0:2.5.9-1.el4
finch
Red Hat:enterprise_linux:4::desktop
 before 0:2.5.9-1.el4
0:2.5.9-1.el4
finch-devel
Red Hat:enterprise_linux:4::desktop
 before 0:2.5.9-1.el4
0:2.5.9-1.el4
libpurple
Red Hat:enterprise_linux:4::desktop
 before 0:2.5.9-1.el4
0:2.5.9-1.el4
libpurple-devel
Red Hat:enterprise_linux:4::desktop
 before 0:2.5.9-1.el4
0:2.5.9-1.el4
libpurple-perl
Red Hat:enterprise_linux:4::desktop
 before 0:2.5.9-1.el4
0:2.5.9-1.el4
libpurple-tcl
Red Hat:enterprise_linux:4::desktop
 before 0:2.5.9-1.el4
0:2.5.9-1.el4
pidgin
Red Hat:enterprise_linux:4::desktop
 before 0:2.5.9-1.el4
0:2.5.9-1.el4
pidgin-debuginfo
Red Hat:enterprise_linux:4::desktop
 before 0:2.5.9-1.el4
0:2.5.9-1.el4
pidgin-devel
Red Hat:enterprise_linux:4::desktop
 before 0:2.5.9-1.el4
0:2.5.9-1.el4
pidgin-perl
Red Hat:enterprise_linux:4::desktop
 before 0:2.5.9-1.el4
0:2.5.9-1.el4
finch
Red Hat:enterprise_linux:4::es
 before 0:2.5.9-1.el4
0:2.5.9-1.el4
finch-devel
Red Hat:enterprise_linux:4::es
 before 0:2.5.9-1.el4
0:2.5.9-1.el4
libpurple
Red Hat:enterprise_linux:4::es
 before 0:2.5.9-1.el4
0:2.5.9-1.el4
libpurple-devel
Red Hat:enterprise_linux:4::es
 before 0:2.5.9-1.el4
0:2.5.9-1.el4
libpurple-perl
Red Hat:enterprise_linux:4::es
 before 0:2.5.9-1.el4
0:2.5.9-1.el4
libpurple-tcl
Red Hat:enterprise_linux:4::es
 before 0:2.5.9-1.el4
0:2.5.9-1.el4
pidgin
Red Hat:enterprise_linux:4::es
 before 0:2.5.9-1.el4
0:2.5.9-1.el4
pidgin-debuginfo
Red Hat:enterprise_linux:4::es
 before 0:2.5.9-1.el4
0:2.5.9-1.el4
pidgin-devel
Red Hat:enterprise_linux:4::es
 before 0:2.5.9-1.el4
0:2.5.9-1.el4
pidgin-perl
Red Hat:enterprise_linux:4::es
 before 0:2.5.9-1.el4
0:2.5.9-1.el4
finch
Red Hat:enterprise_linux:4::ws
 before 0:2.5.9-1.el4
0:2.5.9-1.el4
finch-devel
Red Hat:enterprise_linux:4::ws
 before 0:2.5.9-1.el4
0:2.5.9-1.el4
libpurple
Red Hat:enterprise_linux:4::ws
 before 0:2.5.9-1.el4
0:2.5.9-1.el4
libpurple-devel
Red Hat:enterprise_linux:4::ws
 before 0:2.5.9-1.el4
0:2.5.9-1.el4
libpurple-perl
Red Hat:enterprise_linux:4::ws
 before 0:2.5.9-1.el4
0:2.5.9-1.el4
libpurple-tcl
Red Hat:enterprise_linux:4::ws
 before 0:2.5.9-1.el4
0:2.5.9-1.el4
pidgin
Red Hat:enterprise_linux:4::ws
 before 0:2.5.9-1.el4
0:2.5.9-1.el4
pidgin-debuginfo
Red Hat:enterprise_linux:4::ws
 before 0:2.5.9-1.el4
0:2.5.9-1.el4
pidgin-devel
Red Hat:enterprise_linux:4::ws
 before 0:2.5.9-1.el4
0:2.5.9-1.el4
pidgin-perl
Red Hat:enterprise_linux:4::ws
 before 0:2.5.9-1.el4
0:2.5.9-1.el4
finch-devel
Red Hat:enterprise_linux:5::client_workstation
 before 0:2.5.9-1.el5
0:2.5.9-1.el5
libpurple-devel
Red Hat:enterprise_linux:5::client_workstation
 before 0:2.5.9-1.el5
0:2.5.9-1.el5
pidgin
Red Hat:enterprise_linux:5::client_workstation
 before 0:2.5.9-1.el5
0:2.5.9-1.el5
pidgin-debuginfo
Red Hat:enterprise_linux:5::client_workstation
 before 0:2.5.9-1.el5
0:2.5.9-1.el5
pidgin-devel
Red Hat:enterprise_linux:5::client_workstation
 before 0:2.5.9-1.el5
0:2.5.9-1.el5
finch
Red Hat:enterprise_linux:5::client
 before 0:2.5.9-1.el5
0:2.5.9-1.el5
libpurple
Red Hat:enterprise_linux:5::client
 before 0:2.5.9-1.el5
0:2.5.9-1.el5
libpurple-perl
Red Hat:enterprise_linux:5::client
 before 0:2.5.9-1.el5
0:2.5.9-1.el5
libpurple-tcl
Red Hat:enterprise_linux:5::client
 before 0:2.5.9-1.el5
0:2.5.9-1.el5
pidgin
Red Hat:enterprise_linux:5::client
 before 0:2.5.9-1.el5
0:2.5.9-1.el5
pidgin-debuginfo
Red Hat:enterprise_linux:5::client
 before 0:2.5.9-1.el5
0:2.5.9-1.el5
pidgin-perl
Red Hat:enterprise_linux:5::client
 before 0:2.5.9-1.el5
0:2.5.9-1.el5
finch
Red Hat:rhel_productivity:5
 before 0:2.5.9-1.el5
0:2.5.9-1.el5
finch-devel
Red Hat:rhel_productivity:5
 before 0:2.5.9-1.el5
0:2.5.9-1.el5
libpurple
Red Hat:rhel_productivity:5
 before 0:2.5.9-1.el5
0:2.5.9-1.el5
libpurple-devel
Red Hat:rhel_productivity:5
 before 0:2.5.9-1.el5
0:2.5.9-1.el5
libpurple-perl
Red Hat:rhel_productivity:5
 before 0:2.5.9-1.el5
0:2.5.9-1.el5
libpurple-tcl
Red Hat:rhel_productivity:5
 before 0:2.5.9-1.el5
0:2.5.9-1.el5
pidgin
Red Hat:rhel_productivity:5
 before 0:2.5.9-1.el5
0:2.5.9-1.el5
pidgin-debuginfo
Red Hat:rhel_productivity:5
 before 0:2.5.9-1.el5
0:2.5.9-1.el5
pidgin-devel
Red Hat:rhel_productivity:5
 before 0:2.5.9-1.el5
0:2.5.9-1.el5
pidgin-perl
Red Hat:rhel_productivity:5
 before 0:2.5.9-1.el5
0:2.5.9-1.el5

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
SourceLinkDate
Exploit-DBPidgin MSN 2.5.8 - Remote Code Execution2009-09-09

History

History
RecordedChangedSources
facts
aliasesEUVD
first indexedCVE List, Exploit-DB, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2009-2694 is a high vulnerability (CVSS 10.0) in Adium, published August 19, 2009. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 20.3%, the 97th percentile. Fixed in pidgin 2.5.9-1.

References

Show 60 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open