The AIM/ICQ module in Gaim allows remote attackers to cause a denial of
service (application crash) via a filename that contains invalid UTF-8
characters.
CVE-2005-2370
Multiple memory alignment errors in libgadu, as used in gaim and other
packages, allow remote attackers to cause a denial of service (bus error)
on certain architectures such as SPARC via an incoming message.
CVE-2005-2103
Buffer overflow in the AIM and ICQ module in Gaim allows remote attackers
to cause a denial of service (application crash) and possibly execute
arbitrary code via an away message with a large number of AIM substitution
strings, such as %t or %n.
For the testing distribution (etch) this is fixed in version 1:1.4.0-5etch2
For the unstable distribution (sid) this is fixed in version 1:1.4.0-5
This upgrade is recommended if you use gaim.
If you have the secure testing lines in your sources.list, you can update by running this command as root:
apt-get update && apt-get install gaim
The Debian testing security team does not track security issues for then stable (sarge) and oldstable (woody) distributions. If stable is vulnerable, the Debian security team will make an announcement once a fix is ready.
To use the Debian testing security archive, add the following lines to your /etc/apt/sources.list:
deb http://secure-testing.debian.net/debian-secure-testing etch/security-updates main contrib non-free
deb-src http://secure-testing.debian.net/debian-secure-testing etch/security-updates main contrib non-free