Buffer overflow in Pidgin - CVE-2013-6490
Published: February 6, 2014 / Updated: August 10, 2020
Vulnerability identifier: #VU42055
CSH Severity: High
CVSS v4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2013-6490
CWE-ID: CWE-119
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote non-authenticated attacker to execute arbitrary code.
The SIMPLE protocol functionality in Pidgin before 2.10.8 allows remote attackers to have an unspecified impact via a negative Content-Length header, which triggers a buffer overflow.
Affected software
Pidgin
Gentoo Linux
Ubuntu
Slackware Linux
libpurple0 (Ubuntu package)
pidgin (Ubuntu package)
Gentoo Linux
Ubuntu
Slackware Linux
libpurple0 (Ubuntu package)
pidgin (Ubuntu package)
How to mitigate CVE-2013-6490
Install update from vendor's website.
libpurple0 (Ubuntu package) - addressed in versions 1:2.10.3-0ubuntu1.4, 1:2.10.6-0ubuntu2.3, 1:2.10.7-0ubuntu4.1.13.10.1
pidgin (Ubuntu package) - addressed in versions 1:2.10.3-0ubuntu1.4, 1:2.10.6-0ubuntu2.3, 1:2.10.7-0ubuntu4.1.13.10.1
pidgin (Ubuntu package) - addressed in versions 1:2.10.3-0ubuntu1.4, 1:2.10.6-0ubuntu2.3, 1:2.10.7-0ubuntu4.1.13.10.1