VulnerabilityModified
CVE-2008-2957
The UPnP functionality in Pidgin 2.0.0, and possibly other versions, allows remote attackers to trigger the download of arbitrary files and cause a denial of service (memory or disk consumption) via a UDP packet that specifies an arbitrary URL.
MEDIUM 6.4EPSS 2.10%
Does this matter?
Lower severity and a low EPSS score (2.10%). Track it; it rarely justifies an emergency change on its own.
Description
The UPnP functionality in Pidgin 2.0.0, and possibly other versions, allows remote attackers to trigger the download of arbitrary files and cause a denial of service (memory or disk consumption) via a UDP packet that specifies an arbitrary URL.
- CVSS 2.0
- 6.4 MEDIUMAV:N/AC:L/Au:N/C:N/I:P/A:P
- EPSS
- 2.10% probability · 81th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-20
- Affected
- pidgin/pidgin
- Source
- secalert@redhat.com
References
- http://crisp.cs.du.edu/?q=ca2007-1
- http://secunia.com/advisories/32859
- http://secunia.com/advisories/33102
- http://support.avaya.com/elmodocs2/security/ASA-2008-493.htm
- http://www.mandriva.com/security/advisories?name=MDVSA-2009:025
- http://www.openwall.com/lists/oss-security/2008/06/27/3
- http://www.redhat.com/support/errata/RHSA-2008-1023.html
- http://www.securityfocus.com/bid/29985
- http://www.ubuntu.com/usn/USN-675-1
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A17599
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9076
- http://crisp.cs.du.edu/?q=ca2007-1
- http://secunia.com/advisories/32859
- http://secunia.com/advisories/33102
- http://support.avaya.com/elmodocs2/security/ASA-2008-493.htm
- http://www.mandriva.com/security/advisories?name=MDVSA-2009:025
- http://www.openwall.com/lists/oss-security/2008/06/27/3
- http://www.redhat.com/support/errata/RHSA-2008-1023.html
- http://www.securityfocus.com/bid/29985
- http://www.ubuntu.com/usn/USN-675-1
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A17599
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9076
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.