Pidgin Security Advisory

TitleMSN strncpy buffer overflow
Date2004-08-22
CVE NameCVE-2004-0500
Discovered BySebastian Krahmer, SUSE Security Team
SummaryPossible for a remote MSN user to cause a buffer overflow.
DescriptionIn two places in the MSN protocol plugins (object.c and slp.c), strncpy was used incorrectly; the size of the array was not checked before copying to it. Both bugs affect MSN's MSNSLP protocol, which is peer-to-peer, so this could potentially be easy to exploit.
Fixed in Version0.82
FixBounds checking was added in both places.

Return to Security Advisory Index