CVE-2009-2694

The msn_slplink_process_msg function in libpurple/protocols/msn/slplink.c in libpurple, as used in Pidgin (formerly Gaim) before 2.5.9 and Adium 1.3.5 and earlier, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) by sending multiple crafted SLP (aka MSNSLP) messages to trigger an overwrite of an arbitrary memory location. NOTE: this issue reportedly exists because of an incomplete fix for CVE-2009-1376.

• CWE-399

• http://developer.pidgin.im/viewmtn/revision/info/6f7343166c673bf0496ecb1afec9b633c1d54a0ePatch
• http://developer.pidgin.im/wiki/ChangeLog
• http://secunia.com/advisories/36384Vendor Advisory
• http://secunia.com/advisories/36392Vendor Advisory
• http://secunia.com/advisories/36401Vendor Advisory
• http://secunia.com/advisories/36402
• http://secunia.com/advisories/36708
• http://secunia.com/advisories/37071
• http://sunsolve.sun.com/search/document.do?assetkey=1-66-266908-1
• http://www.coresecurity.com/content/libpurple-arbitrary-writeExploit
• http://www.debian.org/security/2009/dsa-1870Patch
• http://www.exploit-db.com/exploits/9615
• http://www.pidgin.im/news/security/?id=34Vendor Advisory
• http://www.vupen.com/english/advisories/2009/2303Vendor Advisory
• http://www.vupen.com/english/advisories/2009/2663
• https://bugzilla.redhat.com/show_bug.cgi?id=514957
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10319
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6320
• https://rhn.redhat.com/errata/RHSA-2009-1218.htmlVendor Advisory
• http://developer.pidgin.im/viewmtn/revision/info/6f7343166c673bf0496ecb1afec9b633c1d54a0ePatch
• http://developer.pidgin.im/wiki/ChangeLog
• http://secunia.com/advisories/36384Vendor Advisory
• http://secunia.com/advisories/36392Vendor Advisory
• http://secunia.com/advisories/36401Vendor Advisory
• http://secunia.com/advisories/36402
• http://secunia.com/advisories/36708
• http://secunia.com/advisories/37071
• http://sunsolve.sun.com/search/document.do?assetkey=1-66-266908-1
• http://www.coresecurity.com/content/libpurple-arbitrary-writeExploit
• http://www.debian.org/security/2009/dsa-1870Patch
• http://www.exploit-db.com/exploits/9615
• http://www.pidgin.im/news/security/?id=34Vendor Advisory
• http://www.vupen.com/english/advisories/2009/2303Vendor Advisory
• http://www.vupen.com/english/advisories/2009/2663
• https://bugzilla.redhat.com/show_bug.cgi?id=514957
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10319
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6320
• https://rhn.redhat.com/errata/RHSA-2009-1218.htmlVendor Advisory

Published

Aug 21, 2009

Last Modified

Jun 16, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2009-2688Multiple integer overflows in glyphs-eimage.c in XEmacs 21.4…
• CVE-2009-2689JDK13Services.getProviders in Sun Java SE 5.0 before Update …
• CVE-2009-2690The encoder in Sun Java SE 6 before Update 15, and OpenJDK, …
• CVE-2009-2691The mm_for_maps function in fs/proc/base.c in the Linux kern…
• CVE-2009-2692The Linux kernel 2.6.0 through 2.6.30.4, and 2.4.4 through 2…7.8
• CVE-2009-2693Directory traversal vulnerability in Apache Tomcat 5.5.0 thr…
• CVE-2009-2695The Linux kernel before 2.6.31-rc7 does not properly prevent…
• CVE-2009-2696Cross-site scripting (XSS) vulnerability in jsp/cal/cal2.jsp…
• CVE-2009-2697The Red Hat build script for the GNOME Display Manager (GDM)…
• CVE-2009-2698The udp_sendmsg function in the UDP implementation in (1) ne…7.8
• CVE-2009-2699The Solaris pollset feature in the Event Port backend in pol…7.5
• CVE-2009-2700src/network/ssl/qsslcertificate.cpp in Nokia Trolltech Qt 4.…