Gaim: Denial of Service and buffer overflow vulnerabilties
Gentoo Linux Security Advisory
||GLSA 200505-09 / gaim
||May 12, 2005
||May 12, 2005: 01
All supported architectures
Gaim contains two vulnerabilities, potentially resulting in the execution
of arbitrary code or Denial of Service.
Gaim is a full featured instant messaging client which handles a
variety of instant messaging protocols.
Stu Tomlinson discovered that Gaim is vulnerable to a remote stack
based buffer overflow when receiving messages in certain protocols,
like Jabber and SILC, with a very long URL (CAN-2005-1261). Siebe
Tolsma discovered that Gaim is also vulnerable to a remote Denial of
Service attack when receiving a specially crafted MSN message
A remote attacker could cause a buffer overflow by sending an
instant message with a very long URL, potentially leading to the
execution of malicious code. By sending a SLP message with an empty
body, a remote attacker could cause a Denial of Service or crash of the
There are no known workarounds at this time.
All Gaim users should upgrade to the latest version:
Code Listing 3.1: Resolution
# emerge --sync
# emerge --ask --oneshot --verbose ">=net-im/gaim-1.3.0"