www: b72ab1ff: Add the yahoo url crash to the list :-(

[markdoliner at pidgin.im]

-----------------------------------------------------------------
Revision: b72ab1ff79bb9066bc3153a3ed6dde5bdd0c551e
Ancestor: fe84c7ed8ef52302b894e61a698445b5c0363df1
Author: markdoliner at pidgin.im
Date: 2009-08-22T17:58:55
Branch: im.pidgin.www
URL: http://d.pidgin.im/viewmtn/revision/info/b72ab1ff79bb9066bc3153a3ed6dde5bdd0c551e

Modified files:
        htdocs/news/security/index.php

ChangeLog: 

Add the yahoo url crash to the list :-(

-------------- next part --------------
============================================================
--- htdocs/news/security/index.php	10847ad5e544028e8359ffce2ca371f6d587389b
+++ htdocs/news/security/index.php	eb2c5eb6646e8ffb003ba6eabc76cb180694757e
@@ -363,10 +363,20 @@ $vulnerabilities = array(
 		"date"         => "18 August 2009",
 		"cve"          => "CVE-2009-2694",
 		"summary"      => "Specially crafted SLP messages can cause a buffer overflow",
-		"description"  => "By sending two consecutive specially crafted SLP messages it is possible to trigger an memcpy to an invalid location in memory.",
+		"description"  => "By sending two consecutive specially crafted SLP messages it is possible to trigger an memcpy to an invalid location in memory.  This affects all versions of libpurple and Gaim released in the past few years.",
 		"fix"          => "Correctly destroy outgoing SLP ACK messages after they are sent, and ensure a buffer has been allocated within the SLP data structure before attempting to write to it.",
 		"fixedversion" => "2.5.9",
 		"discoveredby" => "Core Security Technologies"
+	),
+	array(
+		"title"        => "Yahoo IM parsing crash",
+		"date"         => "22 August 2009",
+		"cve"          => "",
+		"summary"      => "Crash in Yahoo protocol plugin when receiving an IM",
+		"description"  => "Possibly depending on the architecture and/or flags used to compile libpurple, the Yahoo protocol plugin may crash when receiving an IM from any user which contains a URL.  The only vulnerable version of libpurple is 2.6.0.",
+		"fix"          => "Correctly parse URLs in incoming Yahoo messages.",
+		"fixedversion" => "2.6.1",
+		"discoveredby" => "adk"
 	)
 );
 /*	Template for the unfortunate future