CVE-2009-1889
Last modified
CVE-2009-1889 is a vulnerability of currently unknown severity. The OSCAR protocol implementation in Pidgin before 2.5.8 misinterprets the ICQWebMessage message type as the ICQSMS message type, which allows remote attackers to cause a denial of service (application crash) via a crafted ICQ web message that triggers allocation of a large amount of memory.. EPSS estimates a 3.38% chance of exploitation in the next 30 days.
Description
The OSCAR protocol implementation in Pidgin before 2.5.8 misinterprets the ICQWebMessage message type as the ICQSMS message type, which allows remote attackers to cause a denial of service (application crash) via a crafted ICQ web message that triggers allocation of a large amount of memory.
Metrics
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Pidgin | Pidgin | <= 2.5.7 |
| Pidgin | Pidgin | 2.0.0 |
| Pidgin | Pidgin | 2.0.1 |
| Pidgin | Pidgin | 2.0.2 |
| Pidgin | Pidgin | 2.1.0 |
| Pidgin | Pidgin | 2.1.1 |
| Pidgin | Pidgin | 2.2.0 |
| Pidgin | Pidgin | 2.2.1 |
| Pidgin | Pidgin | 2.2.2 |
| Pidgin | Pidgin | 2.3.0 |
| Pidgin | Pidgin | 2.3.1 |
| Pidgin | Pidgin | 2.4.0 |
| Pidgin | Pidgin | 2.4.1 |
| Pidgin | Pidgin | 2.4.2 |
| Pidgin | Pidgin | 2.4.3 |
| Pidgin | Pidgin | 2.5.0 |
| Pidgin | Pidgin | 2.5.1 |
| Pidgin | Pidgin | 2.5.2 |
| Pidgin | Pidgin | 2.5.3 |
| Pidgin | Pidgin | 2.5.4 |
| Pidgin | Pidgin | 2.5.5 |
| Pidgin | Pidgin | 2.5.6 |
References
- http://developer.pidgin.im/ticket/9483Patch, Vendor Advisory
- http://developer.pidgin.im/ticket/9483Patch, Vendor Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2009-1889?
How severe is CVE-2009-1889?
How do I fix CVE-2009-1889?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2009
- CVE-2009-1883The z90crypt_unlocked_ioctl function in the z90crypt driver …
- CVE-2009-1884Off-by-one error in the bzinflate function in Bzip2.xs in th…
- CVE-2009-1885Stack consumption vulnerability in validators/DTD/DTDScanner…
- CVE-2009-1886Multiple format string vulnerabilities in client/client.c in…
- CVE-2009-1887agent/snmp_agent.c in snmpd in net-snmp 5.0.9 in Red Hat Ent…
- CVE-2009-1888The acl_group_override function in smbd/posix_acls.c in smbd…
- CVE-2009-1890The stream_reqbody_cl function in mod_proxy_http.c in the mo…
- CVE-2009-1891The mod_deflate module in Apache httpd 2.2.11 and earlier co…
- CVE-2009-1892dhcpd in ISC DHCP 3.0.4 and 3.1.1, when the dhcp-client-iden…
- CVE-2009-1893The configtest function in the Red Hat dhcpd init script for…
- CVE-2009-1894Race condition in PulseAudio 0.9.9, 0.9.10, and 0.9.14 allow…
- CVE-2009-1895The personality subsystem in the Linux kernel before 2.6.31-…
Are you affected by CVE-2009-1889?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST