VulnerabilityModified
CVE-2012-2318
msg.c in the MSN protocol plugin in libpurple in Pidgin before 2.10.4 does not properly handle crafted characters, which allows remote servers to cause a denial of service (application crash) by placing these characters in a text/plain message.
MEDIUM 5.0EPSS 1.71%
Does this matter?
Lower severity and a low EPSS score (1.71%). Track it; it rarely justifies an emergency change on its own.
Description
msg.c in the MSN protocol plugin in libpurple in Pidgin before 2.10.4 does not properly handle crafted characters, which allows remote servers to cause a denial of service (application crash) by placing these characters in a text/plain message.
- CVSS 2.0
- 5.0 MEDIUMAV:N/AC:L/Au:N/C:N/I:N/A:P
- EPSS
- 1.71% probability · 76th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-20
- Affected
- pidgin/pidgin
- Source
- secalert@redhat.com
References
- http://hg.pidgin.im/pidgin/main/rev/4d6bcb4f4ea4Exploit, Patch
- http://pidgin.im/news/security/?id=63Patch, Vendor Advisory
- http://rhn.redhat.com/errata/RHSA-2012-1102.html
- http://secunia.com/advisories/50005
- http://www.mandriva.com/security/advisories?name=MDVSA-2012:082
- http://www.securityfocus.com/bid/53400
- https://hermes.opensuse.org/messages/15136503
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A17448
- http://hg.pidgin.im/pidgin/main/rev/4d6bcb4f4ea4Exploit, Patch
- http://pidgin.im/news/security/?id=63Patch, Vendor Advisory
- http://rhn.redhat.com/errata/RHSA-2012-1102.html
- http://secunia.com/advisories/50005
- http://www.mandriva.com/security/advisories?name=MDVSA-2012:082
- http://www.securityfocus.com/bid/53400
- https://hermes.opensuse.org/messages/15136503
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A17448
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.