DESCRIPTION
Gaim[1] is a multi-protocol instant messaging (IM) client.
This announcement fixes several denial of service and buffer overflow
vulnerabilities that were encountered in Gaim.
The fixed vulnerabilities are:
CAN-2004-0500[2]: Buffer overflow in the MSN protocol plugins
object.c and slp.c allows remote attackers to cause a denial of
service and possibly execute arbitrary code via MSNSLP protocol
messages that are not properly handled in a strncpy call.
CAN-2004-0754[3]: Integer overflow in Gaim allows remote attackers to
cause a denial of service and possibly execute arbitrary code via the
size variable in Groupware server messages.
CAN-2004-0784[4]: The smiley theme functionality in Gaim allows
remote attackers to execute arbitrary commands via shell
metacharacters in the filename of the tar file that is dragged to the
smiley selector.
CAN-2004-0785[5]: Multiple buffer overflows in Gaim allow remote
attackers to cause a denial of service and possibly execute arbitrary
code via Rich Text Format (RTF) messages, a long hostname for the
local system as obtained from DNS, or a long URL that is not properly
handled by the URL decoder.
For further informations on Gaim's vulnerabilities, please refer to
the project's security page[6].
SOLUTION
It is recommended that all Gaim users upgrade their packages.
IMPORTANT: Gaim must be restarted after the upgrade in order to close
the vulnerabilities.
