libgadu before 1.11.4 and 1.12.0 before 1.12.0-rc3, as used in Pidgin and other products, allows remote Gadu-Gadu file relay servers to cause a denial of service (memory overwrite) or possibly execute arbitrary code via a crafted message.
{ "availability": "No subscription required", "ubuntu_priority": "medium", "binaries": [ { "binary_version": "1:2.10.9-0ubuntu3.1", "binary_name": "finch" }, { "binary_version": "1:2.10.9-0ubuntu3.1", "binary_name": "finch-dev" }, { "binary_version": "1:2.10.9-0ubuntu3.1", "binary_name": "libpurple-bin" }, { "binary_version": "1:2.10.9-0ubuntu3.1", "binary_name": "libpurple-dev" }, { "binary_version": "1:2.10.9-0ubuntu3.1", "binary_name": "libpurple0" }, { "binary_version": "1:2.10.9-0ubuntu3.1", "binary_name": "pidgin" }, { "binary_version": "1:2.10.9-0ubuntu3.1", "binary_name": "pidgin-data" }, { "binary_version": "1:2.10.9-0ubuntu3.1", "binary_name": "pidgin-dbg" }, { "binary_version": "1:2.10.9-0ubuntu3.1", "binary_name": "pidgin-dev" } ] }