Input validation error in Pidgin - CVE-2013-0274
Published: February 16, 2013 / Updated: August 4, 2020
Vulnerability identifier: #VU33912
CSH Severity: Low
CVSS v4: 5.3 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
CVE-ID: CVE-2013-0274
CWE-ID: CWE-20
Exploitation vector: Adjecent network
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote non-authenticated attacker to perform service disruption.
upnp.c in libpurple in Pidgin before 2.10.7 does not properly terminate long strings in UPnP responses, which allows remote attackers to cause a denial of service (application crash) by leveraging access to the local network.
Affected software
Pidgin
Gentoo Linux
Slackware Linux
pidgin (Alpine package)
Gentoo Linux
Slackware Linux
pidgin (Alpine package)
How to mitigate CVE-2013-0274
Install update from vendor's website.
Pidgin - update to 2.10.7
pidgin (Alpine package) - update to 2.10.7-r0
pidgin (Alpine package) - update to 2.10.7-r0
External References
- http://hg.pidgin.im/pidgin/main/rev/ad7e7fb98db3
- http://lists.opensuse.org/opensuse-security-announce/2013-03/msg00003.html
- http://lists.opensuse.org/opensuse-security-announce/2013-03/msg00006.html
- http://lists.opensuse.org/opensuse-security-announce/2013-03/msg00007.html
- http://www.pidgin.im/news/security/?id=68
- http://www.ubuntu.com/usn/USN-1746-1
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A18221