OpenBSD VuXML: Documenting security issues in the OpenBSD Ports & Packages Collection

gaim -- remote execution of arbitrary code

Affected packages
gaim < 1.5.0

Details

VuXML ID 0dfcb310-0f38-11da-ba28-00065bd5b0b6
Discovery 2005-08-11
Entry 2005-08-17

There was a memory alignment bug in the library Gaim uses to access the Gadu-Gadu network. This bug can not be exploited on x86 architectures. This bug was recently fixed in the libgadu library, but also needed to be fixed in Gaim because Gaim includes a copy of the libgadu library.

A remote user could cause Gaim to crash on some systems by sending the Gaim user a file whose filename contains certain invalid characters. It is unknown what combination of systems are affected, but it is suspected that Windows users and systems with older versions of GTK+ are especially susceptible.

A remote AIM or ICQ user can cause a buffer overflow in Gaim by setting an away message containing many AIM substitution strings (such as %t or %n).

References

URL http://gaim.sourceforge.net/security/?id=20
URL http://gaim.sourceforge.net/security/?id=21
URL http://gaim.sourceforge.net/security/?id=22