CVE-2010-0013
Directory traversal vulnerability in slp.c in the MSN protocol plugin in libpurple in Pidgin 2.6.4 and Adium 1.3.8 allows remote attackers to read arbitrary files via a ..
Does this matter?
EPSS puts the probability of exploitation in the next 30 days at 12.5%, higher than 96% of all known CVEs. Patch or mitigate before the next change window.
Description
Directory traversal vulnerability in slp.c in the MSN protocol plugin in libpurple in Pidgin 2.6.4 and Adium 1.3.8 allows remote attackers to read arbitrary files via a .. (dot dot) in an application/x-msnmsgrp2p MSN emoticon (aka custom smiley) request, a related issue to CVE-2004-0122. NOTE: it could be argued that this is resultant from a vulnerability in which an emoticon download request is processed even without a preceding text/x-mms-emoticon message that announced availability of the emoticon.
- CVSS 3.1
- 7.5 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
- EPSS
- 12.50% probability · 96th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-22
- Affected
- adium/adium · pidgin/pidgin · fedoraproject/fedora · opensuse/opensuse · suse/linux enterprise · suse/linux enterprise server · redhat/enterprise linux
- Source
- secalert@redhat.com
References
- http://d.pidgin.im/viewmtn/revision/info/3d02401cf232459fc80c0837d31e05fae7ae5467Broken Link
- http://d.pidgin.im/viewmtn/revision/info/4be2df4f72bd8a55cdae7f2554b73342a497c92fBroken Link
- http://d.pidgin.im/viewmtn/revision/info/c64a1adc8bda2b4aeaae1f273541afbc4f71b810Broken Link
- http://developer.pidgin.im/viewmtn/revision/diff/3d02401cf232459fc80c0837d31e05fae7ae5467/with/c64a1adc8bda2b4aeaae1f273541afbc4f71b810/libpurple/protocols/msn/slp.cBroken Link
- http://events.ccc.de/congress/2009/Fahrplan/events/3596.en.htmlProduct
- http://lists.fedoraproject.org/pipermail/package-announce/2010-January/033771.htmlMailing List
- http://lists.fedoraproject.org/pipermail/package-announce/2010-January/033848.htmlMailing List
- http://lists.opensuse.org/opensuse-security-announce/2010-03/msg00004.htmlMailing List
- http://secunia.com/advisories/37953Broken Link, Vendor Advisory
- http://secunia.com/advisories/37954Broken Link, Vendor Advisory
- http://secunia.com/advisories/37961Broken Link
- http://secunia.com/advisories/38915Broken Link
- http://sunsolve.sun.com/search/document.do?assetkey=1-66-277450-1Broken Link
- http://sunsolve.sun.com/search/document.do?assetkey=1-77-1022203.1-1Broken Link
- http://www.mandriva.com/security/advisories?name=MDVSA-2010:085Broken Link
- http://www.openwall.com/lists/oss-security/2010/01/02/1Mailing List, Patch
- http://www.openwall.com/lists/oss-security/2010/01/07/1Mailing List
- http://www.openwall.com/lists/oss-security/2010/01/07/2Mailing List
- http://www.vupen.com/english/advisories/2009/3662Permissions Required, Vendor Advisory
- http://www.vupen.com/english/advisories/2009/3663Permissions Required, Vendor Advisory
- http://www.vupen.com/english/advisories/2010/1020Permissions Required
- https://bugzilla.redhat.com/show_bug.cgi?id=552483Issue Tracking, Patch
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10333Broken Link
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A17620Broken Link
- http://d.pidgin.im/viewmtn/revision/info/3d02401cf232459fc80c0837d31e05fae7ae5467Broken Link
- http://d.pidgin.im/viewmtn/revision/info/4be2df4f72bd8a55cdae7f2554b73342a497c92fBroken Link
- http://d.pidgin.im/viewmtn/revision/info/c64a1adc8bda2b4aeaae1f273541afbc4f71b810Broken Link
- http://developer.pidgin.im/viewmtn/revision/diff/3d02401cf232459fc80c0837d31e05fae7ae5467/with/c64a1adc8bda2b4aeaae1f273541afbc4f71b810/libpurple/protocols/msn/slp.cBroken Link
- http://events.ccc.de/congress/2009/Fahrplan/events/3596.en.htmlProduct
- http://lists.fedoraproject.org/pipermail/package-announce/2010-January/033771.htmlMailing List
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.