Input validation error in Pidgin - CVE-2013-6489
Published: February 6, 2014 / Updated: August 10, 2020
Vulnerability identifier: #VU42059
CSH Severity: Medium
CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
CVE-ID: CVE-2013-6489
CWE-ID: CWE-20
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote non-authenticated attacker to perform service disruption.
Integer signedness error in the MXit functionality in Pidgin before 2.10.8 allows remote attackers to cause a denial of service (segmentation fault) via a crafted emoticon value, which triggers an integer overflow and a buffer overflow.
Affected software
Pidgin
Gentoo Linux
Ubuntu
Slackware Linux
libpurple0 (Ubuntu package)
pidgin (Ubuntu package)
Gentoo Linux
Ubuntu
Slackware Linux
libpurple0 (Ubuntu package)
pidgin (Ubuntu package)
How to mitigate CVE-2013-6489
Install update from vendor's website.
libpurple0 (Ubuntu package) - addressed in versions 1:2.10.3-0ubuntu1.4, 1:2.10.6-0ubuntu2.3, 1:2.10.7-0ubuntu4.1.13.10.1
pidgin (Ubuntu package) - addressed in versions 1:2.10.3-0ubuntu1.4, 1:2.10.6-0ubuntu2.3, 1:2.10.7-0ubuntu4.1.13.10.1
pidgin (Ubuntu package) - addressed in versions 1:2.10.3-0ubuntu1.4, 1:2.10.6-0ubuntu2.3, 1:2.10.7-0ubuntu4.1.13.10.1