FreshPorts - VuXML

This page displays vulnerability information about FreeBSD Ports.

The VUXML data was last processed by FreshPorts on 2024-03-28 15:43:32 UTC

List all Vulnerabilities, by package

List all Vulnerabilities, by date

k68

These are the vulnerabilities relating to the commit you have selected:

VuXML IDDescription
09db2844-0b21-11da-bc08-0001020eed82gaim -- AIM/ICQ non-UTF-8 filename crash

The GAIM team reports:

A remote user could cause Gaim to crash on some systems by sending the Gaim user a file whose filename contains certain invalid characters. It is unknown what combination of systems are affected, but it is suspected that Windows users and systems with older versions of GTK+ are especially susceptible.


Discovery 2005-08-09
Entry 2005-08-12
gaim
ja-gaim
ko-gaim
ru-gaim
< 1.4.0_1

CVE-2005-2102
http://gaim.sourceforge.net/security/?id=21
142353df-b5cc-11d9-a788-0001020eed82gaim -- remote DoS on receiving malformed HTML

The GAIM team reports:

Receiving malformed HTML can result in an invalid memory access causing Gaim to crash.


Discovery 2005-02-17
Entry 2005-04-25
gaim
ja-gaim
ko-gaim
ru-gaim
< 1.1.4

CVE-2005-0208
CVE-2005-0473
http://gaim.sourceforge.net/security/index.php?id=11
http://gaim.sourceforge.net/security/index.php?id=12
2701611f-df5c-11d9-b875-0001020eed82gaim -- Yahoo! remote crash vulnerability

Jacopo Ottaviani reports that Gaim can be crashed by being offered files with names containing non-ASCII characters via the Yahoo! protocol.


Discovery 2005-06-10
Entry 2005-06-17
gaim
ja-gaim
ko-gaim
ru-gaim
< 1.3.1

13931
CVE-2005-1269
http://gaim.sourceforge.net/security/index.php?id=18
3b4a6982-0b24-11da-bc08-0001020eed82libgadu -- multiple vulnerabilities

Wojtek Kaniewski reports:

Multiple vulnerabilities have been found in libgadu, a library for handling Gadu-Gadu instant messaging protocol. It is a part of ekg, a Gadu-Gadu client, but is widely used in other clients. Also some of the user contributed scripts were found to behave in an insecure manner.

  • integer overflow in libgadu (CVE-2005-1852) that could be triggered by an incomming message and lead to application crash and/or remote code execution
  • insecure file creation (CVE-2005-1850) and shell command injection (CVE-2005-1851) in other user contributed scripts (discovered by Marcin Owsiany and Wojtek Kaniewski)
  • several signedness errors in libgadu that could be triggered by an incomming network data or an application passing invalid user input to the library
  • memory alignment errors in libgadu that could be triggered by an incomming message and lead to bus errors on architectures like SPARC
  • endianness errors in libgadu that could cause invalid behaviour of applications on big-endian architectures

Discovery 2005-07-21
Entry 2005-08-12
Modified 2005-10-23
gaim
ja-gaim
ko-gaim
ru-gaim
< 1.4.0_1

kdenetwork
gt 3.2.2 lt 3.4.2

pl-ekg
< 1.6r3,1

centericq
< 4.21.0_1

14345
CVE-2005-1850
CVE-2005-1851
CVE-2005-1852
CVE-2005-2369
CVE-2005-2370
CVE-2005-2448
http://marc.theaimsgroup.com/?l=bugtraq&m=112198499417250
http://gaim.sourceforge.net/security/?id=20
http://www.kde.org/info/security/advisory-20050721-1.txt
3fa2b372-a9f5-11d9-a788-0001020eed82gaim -- remote DoS on receiving malformed HTML

The GAIM team reports:

The gaim_markup_strip_html function in Gaim 1.2.0, and possibly earlier versions, allows remote attackers to cause a denial of service (application crash) via a string that contains malformed HTML, which causes an out-of-bounds read.


Discovery 2005-04-02
Entry 2005-04-10
gaim
ja-gaim
ko-gaim
ru-gaim
< 1.2.1

12999
CVE-2005-0965
http://gaim.sourceforge.net/security/?id=13
4260eacb-26b8-11d9-9289-000c41e2cdadgaim -- multiple buffer overflows

Sean infamous42md reports several situations in gaim that may result in exploitable buffer overflows:

  • Rich Text Format (RTF) messages in Novell GroupWise protocol
  • Unsafe use of gethostbyname in zephyr protocol
  • URLs which are over 2048 bytes long once decoded

Discovery 2004-08-26
Entry 2004-10-25
gaim
ja-gaim
ko-gaim
ru-gaim
< 0.82

gaim
gt 20030000

CVE-2004-0785
http://gaim.sourceforge.net/security/?id=3
http://gaim.sourceforge.net/security/?id=4
http://gaim.sourceforge.net/security/?id=5
5b8f9a02-ec93-11d8-b913-000c41e2cdadgaim remotely exploitable vulnerabilities in MSN component

Sebastian Krahmer discovered several remotely exploitable buffer overflow vulnerabilities in the MSN component of gaim.

In two places in the MSN protocol plugins (object.c and slp.c), strncpy was used incorrectly; the size of the array was not checked before copying to it. Both bugs affect MSN's MSNSLP protocol, which is peer-to-peer, so this could potentially be easy to exploit.


Discovery 2004-08-12
Entry 2004-08-12
Modified 2004-10-25
gaim
ja-gaim
ko-gaim
ru-gaim
< 0.81_1

gaim
ge 20030000

CVE-2004-0500
http://gaim.sourceforge.net/security/?id=0
635bf5f4-26b7-11d9-9289-000c41e2cdadgaim -- malicious smiley themes

The Gaim Security Issues page documents a problem with installing smiley themes from an untrusted source:

To install a new smiley theme, a user can drag a tarball from a graphical file manager, or a hypertext link to one from a web browser. When a tarball is dragged, Gaim executes a shell command to untar it. However, it does not escape the filename before sending it to the shell. Thus, a specially crafted filename could execute arbitrary commands if the user could be convinced to drag a file into the smiley theme selector.


Discovery 2004-08-22
Entry 2004-10-25
gaim
ja-gaim
ko-gaim
ru-gaim
< 0.82

gaim
gt 20030000

CVE-2004-0784
http://gaim.sourceforge.net/security/?id=1
6d1761d2-0b23-11da-bc08-0001020eed82gaim -- AIM/ICQ away message buffer overflow

The GAIM team reports:

A remote AIM or ICQ user can cause a buffer overflow in Gaim by setting an away message containing many AIM substitution strings (such as %t or %n).


Discovery 2005-08-09
Entry 2005-08-12
gaim
ja-gaim
ko-gaim
ru-gaim
< 1.4.0_1

CVE-2005-2103
http://gaim.sourceforge.net/security/?id=22
6fd02439-5d70-11d8-80e3-0020ed76ef5aSeveral remotely exploitable buffer overflows in gaim

Stefan Esser of e-matters found almost a dozen remotely exploitable vulnerabilities in Gaim. From the e-matters advisory:

While developing a custom add-on, an integer overflow in the handling of AIM DirectIM packets was revealed that could lead to a remote compromise of the IM client. After disclosing this bug to the vendor, they had to make a hurried release because of a change in the Yahoo connection procedure that rendered GAIM useless. Unfourtunately at the same time a closer look onto the sourcecode revealed 11 more vulnerabilities.

The 12 identified problems range from simple standard stack overflows, over heap overflows to an integer overflow that can be abused to cause a heap overflow. Due to the nature of instant messaging many of these bugs require man-in-the-middle attacks between client and server. But the underlying protocols are easy to implement and MIM attacks on ordinary TCP sessions is a fairly simple task.

In combination with the latest kernel vulnerabilities or the habit of users to work as root/administrator these bugs can result in remote root compromises.


Discovery 2004-01-26
Entry 2004-02-12
Modified 2004-10-25
gaim
ja-gaim
ko-gaim
ru-gaim
< 0.75_3

eq 0.75_5

eq 0.76

gaim
ge 20030000

http://security.e-matters.de/advisories/012004.txt
CVE-2004-0005
CVE-2004-0006
CVE-2004-0007
CVE-2004-0008
889061af-c427-11d9-ac59-02061b08fc24gaim -- remote crash on some protocols

The GAIM team reports that GAIM is vulnerable to a denial-of-service vulnerability which can cause GAIM to crash:

It is possible for a remote user to overflow a static buffer by sending an IM containing a very large URL (greater than 8192 bytes) to the Gaim user. This is not possible on all protocols, due to message length restrictions. Jabber are SILC are known to be vulnerable.


Discovery 2005-05-10
Entry 2005-05-14
gaim
ja-gaim
ko-gaim
ru-gaim
< 1.3.0

CVE-2005-1261
http://gaim.sourceforge.net/security/index.php?id=16
8b0e94cc-b5cd-11d9-a788-0001020eed82gaim -- AIM/ICQ remote denial of service vulnerability

The GAIM team reports that GAIM is vulnerable to a denial-of-service vulnerability which can cause GAIM to freeze:

Certain malformed SNAC packets sent by other AIM or ICQ users can trigger an infinite loop in Gaim when parsing the SNAC. The remote user would need a custom client, able to generate malformed SNACs.


Discovery 2005-02-17
Entry 2005-04-25
gaim
ja-gaim
ko-gaim
ru-gaim
< 1.1.3

CVE-2005-0472
http://gaim.sourceforge.net/security/index.php?id=10
ad5e70bb-c429-11d9-ac59-02061b08fc24gaim -- MSN remote DoS vulnerability

The GAIM team reports:

Potential remote denial of service bug resulting from not checking a pointer for non-NULL before passing it to strncmp, which results in a crash. This can be triggered by a remote client sending an SLP message with an empty body.


Discovery 2005-05-10
Entry 2005-05-14
gaim
ja-gaim
ko-gaim
ru-gaim
< 1.3.0

CVE-2005-1262
http://gaim.sourceforge.net/security/index.php?id=17
ad61657d-26b9-11d9-9289-000c41e2cdadgaim -- Content-Length header denial-of-service vulnerability

Sean infamous42md reports:

When a remote server provides a large "content-length" header value, Gaim will attempt to allocate a buffer to store the content, however this allocation attempt will cause Gaim to crash if the length exceeds the amount of possible memory. This happens when reading profile information on some protocols. It also happens when smiley themes are installed via drag and drop.


Discovery 2004-08-26
Entry 2004-10-25
gaim
ja-gaim
ko-gaim
ru-gaim
< 0.82

gaim
gt 20030000

http://gaim.sourceforge.net/security/?id=6
b6612eee-df5f-11d9-b875-0001020eed82gaim -- MSN Remote DoS vulnerability

The GAIM team reports:

Remote attackers can cause a denial of service (crash) via a malformed MSN message that leads to a memory allocation of a large size, possibly due to an integer signedness error.


Discovery 2005-06-10
Entry 2005-06-17
gaim
ja-gaim
ko-gaim
ru-gaim
< 1.3.1

13932
CVE-2005-1934
http://gaim.sourceforge.net/security/index.php?id=19
e16293f0-26b7-11d9-9289-000c41e2cdadgaim -- heap overflow exploitable by malicious GroupWise server

Sean infamous42md reports that a malicious GroupWise messaging server may be able to exploit a heap buffer overflow in gaim, leading to arbitrary code execution.


Discovery 2004-08-26
Entry 2004-10-25
gaim
ja-gaim
ko-gaim
ru-gaim
< 0.82

gaim
gt 20030000

CVE-2004-0754
http://gaim.sourceforge.net/security/?id=2
ec09baa3-a9f5-11d9-a788-0001020eed82gaim -- remote DoS on receiving certain messages over IRC

The GAIM team reports:

The IRC protocol plugin in Gaim 1.2.0, and possibly earlier versions, allows (1) remote attackers to inject arbitrary Gaim markup via irc_msg_kick, irc_msg_mode, irc_msg_part, irc_msg_quit, (2) remote attackers to inject arbitrary Pango markup and pop up empty dialog boxes via irc_msg_invite, or (3) malicious IRC servers to cause a denial of service (application crash) by injecting certain Pango markup into irc_msg_badmode, irc_msg_banned, irc_msg_unknown, irc_msg_nochan functions.


Discovery 2005-04-02
Entry 2005-04-10
gaim
ja-gaim
ko-gaim
ru-gaim
< 1.2.1

13003
CVE-2005-0966
http://gaim.sourceforge.net/security/?id=14
ecf68408-a9f5-11d9-a788-0001020eed82gaim -- jabber remote crash

The GAIM team reports:

A remote jabber user can cause Gaim to crash by sending a specific file transfer request.


Discovery 2005-04-04
Entry 2005-04-10
gaim
ja-gaim
ko-gaim
ru-gaim
< 1.2.1

13004
CVE-2005-0967
http://gaim.sourceforge.net/security/?id=15
f2d6a5e1-26b9-11d9-9289-000c41e2cdadgaim -- MSN denial-of-service vulnerabilities

The Gaim team discovered denial-of-service vulnerabilities in the MSN protocol handler:

After accepting a file transfer request, Gaim will attempt to allocate a buffer of a size equal to the entire filesize, this allocation attempt will cause Gaim to crash if the size exceeds the amount of available memory.

Gaim allocates a buffer for the payload of each message received based on the size field in the header of the message. A malicious peer could specify an invalid size that exceeds the amount of available memory.


Discovery 2004-10-19
Entry 2004-10-25
gaim
ja-gaim
ko-gaim
ru-gaim
< 1.0.2

gaim
gt 20030000

http://gaim.sourceforge.net/security/?id=7
http://gaim.sourceforge.net/security/?id=8