CVE:CVE-2008-5402
CNNVD:CNNVD-200812-157
Trillian是一个聊天程序，和多种即时通讯程序使用相同的接口，包括AIM、ICQ、Yahoo! Messenger、MSN Messenger和IRC。
在Trillian 3.1.12.0以前版本的XML解析器中存在两次内存释放漏洞，这允许远程攻击者通过一个特制的XML表达式来执行任意的代码，这可能与"IMG SRC ID."有关。
solution:Upgrade cerulean_studios trillian to a higher version than 0.50,0.52,0.60,0.61,0.62,0.63,0.70,0.71,0.72,0.73,0.74,0.74c,0.74d,0.74e,0.74f,0.74g,0.74i,0.635,0.725,0.6351,1.0,2.0,2.1,3.0,3.1,3.1.0.120,3.1.0.121,3.1.5.0,3.1.5.1,3.1.6.0,3.1.7.0,3.1.8.0,3.1.9.0,3.1.10.0,3.1.11.0,and avoid the version 0.50,0.52,0.60,0.61,0.62,0.63,0.70,0.71,0.72,0.73,0.74,0.74c,0.74d,0.74e,0.74f,0.74g,0.74i,0.635,0.725,0.6351,1.0,2.0,2.1,3.0,3.1,3.1.0.120,3.1.0.121,3.1.5.0,3.1.5.1,3.1.6.0,3.1.7.0,3.1.8.0,3.1.9.0,3.1.10.0,3.1.11.0; Upgrade cerulean_studios trillian_pro to a higher version than *,1.0,2.0,2.01,3.0,3.1.5.0,3.1_build_121,and avoid the version 1.0,2.0,2.01,3.0,3.1.5.0,3.1_build_121; Upgrade ceruleanstudios trillian to a higher version than *,3.1.0.9,3.1.9.0,and avoid the version 3.1.0.9,3.1.9.0; Upgrade ceruleanstudios trillian_pro to a higher version than *,3.1.9.0,and avoid the version 3.1.9.0