SOC status:Duty analyst on shift

UK Cyber Defence
VulnerabilityModified

CVE-2004-0891

Buffer overflow in the MSN protocol handler for gaim 0.79 to 1.0.1 allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via an "unexpected sequence of MSNSLP messages" that results in an unbounded…

HIGH 10.0EPSS 6.86%

Does this matter?

High impact if exploited, but EPSS currently rates exploitation as unlikely (6.86%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.

Description

Buffer overflow in the MSN protocol handler for gaim 0.79 to 1.0.1 allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via an "unexpected sequence of MSNSLP messages" that results in an unbounded copy operation that writes to the wrong buffer.

CVSS 2.0
10.0 HIGHAV:N/AC:L/Au:N/C:C/I:C/A:C
EPSS
6.86% probability · 94th percentile
CISA KEV
Not listed
Affected
rob flynn/gaim · gentoo/linux · slackware/slackware linux · ubuntu/ubuntu linux
Source
cve@mitre.org

References

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.