CVE-2008-2957

Publication date 1 July 2008

Last updated 24 July 2024

The UPnP functionality in Pidgin 2.0.0, and possibly other versions, allows remote attackers to trigger the download of arbitrary files and cause a denial of service (memory or disk consumption) via a UDP packet that specifies an arbitrary URL.

Read the notes from the security team

Status

Show unmaintained releases

Package	Ubuntu Release	Status
gaim	8.10 intrepid	Not in release
	8.04 LTS hardy	Not in release
	7.10 gutsy	Not in release
	7.04 feisty	Ignored end of life, was needs-triage
	6.06 LTS dapper	Not affected
pidgin	8.10 intrepid	Not affected
	8.04 LTS hardy	Fixed 1:2.4.1-1ubuntu2.2
	7.10 gutsy	Fixed 1:2.2.1-1ubuntu4.3
	7.04 feisty	Not in release
	6.06 LTS dapper	Not in release

Notes

mdeslaur

UPnP is not in Dapper, no not affected

Patch details

For informational purposes only. We recommend not to cherry-pick updates. How can I get the fixes?

Package	Patch details
pidgin	Upstream: http://developer.pidgin.im/viewmtn/revision/info/434563a4b8fadb9593c241db4bb5ffd0bf2c0627

CVE-2008-2957

Status

Notes

mdeslaur

Patch details

References

Related Ubuntu Security Notices (USN)

Other references