CVSS: 5.0EPSS: 3%CPEs: 53EXPL: 0CVE-2013-6477 – pidgin: DoS when handling timestamps in the XMPP plugin
https://notcve.org/view.php?id=CVE-2013-6477
Multiple integer signedness errors in libpurple in Pidgin before 2.10.8 allow remote attackers to cause a denial of service (application crash) via a crafted timestamp value in an XMPP message. Múltiples errores de signo de enteros en libpurple en Pidgin anterior a 2.10.8 permiten a atacantes remotos causar una denegación de servicio (caída de la aplicación) a través de un valor timestamp manipulado en un mensaje XMPP. • http://hg.pidgin.im/pidgin/main/rev/852014ae74a0 http://lists.opensuse.org/opensuse-updates/2014-02/msg00039.html http://lists.opensuse.org/opensuse-updates/2014-03/msg00005.html http://pidgin.im/news/security/?id=71 http://www.debian.org/security/2014/dsa-2859 http://www.ubuntu.com/usn/USN-2100-1 https://rhn.redhat.com/errata/RHSA-2014-0139.html https://access.redhat.com/security/cve/CVE-2013-6477 https://bugzilla.redhat.com/show_bug.cgi?id=1056479 • CWE-189: Numeric Errors CWE-190: Integer Overflow or Wraparound •
CVSS: 4.3EPSS: 4%CPEs: 53EXPL: 0CVE-2013-6478 – pidgin: DoS when rendering long URLs
https://notcve.org/view.php?id=CVE-2013-6478
gtkimhtml.c in Pidgin before 2.10.8 does not properly interact with underlying library support for wide Pango layouts, which allows user-assisted remote attackers to cause a denial of service (application crash) via a long URL that is examined with a tooltip. gtkimhtml.c en Pidgin anterior a 2.10.8 no interactua debidamente con la librería subyacente de soporte para un amplio número de diseños de Pango, lo que permite a atacantes remotos asistidos por usuario causar una denegación de servicio (caída de la aplicación) a través de una URL larga que es examinada con una "tooltip". • http://hg.pidgin.im/pidgin/main/rev/2bb66ef1475e http://lists.opensuse.org/opensuse-updates/2014-02/msg00039.html http://lists.opensuse.org/opensuse-updates/2014-03/msg00005.html http://pidgin.im/news/security/?id=72 http://pidgin.im/pipermail/support/2013-March/012980.html http://pidgin.im/pipermail/support/2013-March/012981.html http://www.debian.org/security/2014/dsa-2859 http://www.ubuntu.com/usn/USN-2100-1 https://rhn.redhat.com/errata/RHSA-2014-0139.html h • CWE-20: Improper Input Validation CWE-400: Uncontrolled Resource Consumption •
CVSS: 5.0EPSS: 0%CPEs: 53EXPL: 0CVE-2013-6479 – pidgin: DoS when parsing certain HTTP response headers
https://notcve.org/view.php?id=CVE-2013-6479
util.c in libpurple in Pidgin before 2.10.8 does not properly allocate memory for HTTP responses that are inconsistent with the Content-Length header, which allows remote HTTP servers to cause a denial of service (application crash) via a crafted response. util.c en libpurple en Pidgin anterior a 2.10.8 no reserva correctamente la memoria para las respuestas HTTP que son inconsistentes con la cabecera Content-Length, lo que permite a servidores HTTP remotos causar una denegación de servicio (caída de la aplicación) a través de una respuesta manipulada. • http://hg.pidgin.im/pidgin/main/rev/cd529e1158d3 http://lists.opensuse.org/opensuse-updates/2014-02/msg00039.html http://lists.opensuse.org/opensuse-updates/2014-03/msg00005.html http://pidgin.im/news/security/?id=73 http://www.debian.org/security/2014/dsa-2859 http://www.ubuntu.com/usn/USN-2100-1 https://rhn.redhat.com/errata/RHSA-2014-0139.html https://access.redhat.com/security/cve/CVE-2013-6479 https://bugzilla.redhat.com/show_bug.cgi?id=1056907 • CWE-399: Resource Management Errors •
CVSS: 5.0EPSS: 3%CPEs: 53EXPL: 0CVE-2013-6481 – pidgin: DoS caused due to OOB read in Yahoo protocol plugin
https://notcve.org/view.php?id=CVE-2013-6481
libpurple/protocols/yahoo/libymsg.c in Pidgin before 2.10.8 allows remote attackers to cause a denial of service (crash) via a Yahoo! P2P message with a crafted length field, which triggers a buffer over-read. libpurple/protocols/yahoo/libymsg.c en Pidgin anterior a 2.10.8 permite a atacantes remotos causar una denegación de servicio (caída) a través de un mensaje Yahoo! P2P con un campo "length" manipulado, lo que provoca una sobre-lectura del buffer. • http://hg.pidgin.im/pidgin/main/rev/4d139ce8f7ec http://lists.opensuse.org/opensuse-updates/2014-02/msg00039.html http://lists.opensuse.org/opensuse-updates/2014-03/msg00005.html http://www.debian.org/security/2014/dsa-2859 http://www.pidgin.im/news/security/?id=74 http://www.ubuntu.com/usn/USN-2100-1 https://rhn.redhat.com/errata/RHSA-2014-0139.html https://access.redhat.com/security/cve/CVE-2013-6481 https://bugzilla.redhat.com/show_bug.cgi?id=1056908 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer CWE-125: Out-of-bounds Read •
CVSS: 5.0EPSS: 3%CPEs: 53EXPL: 0CVE-2013-6482 – pidgin: DoS via multiple null pointer dereferences in MSN protocol plugin
https://notcve.org/view.php?id=CVE-2013-6482
Pidgin before 2.10.8 allows remote MSN servers to cause a denial of service (NULL pointer dereference and crash) via a crafted (1) SOAP response, (2) OIM XML response, or (3) Content-Length header. Pidgin anterior a 2.10.8 permite a servidores MSN remotos causar una denegación de servicio (referencia a puntero nulo y caída) a través de (1) una respuesta SOAP, (2) respuesta OIM XML o (3) cabecera Content-Length manipuladas. • http://lists.opensuse.org/opensuse-updates/2014-02/msg00039.html http://lists.opensuse.org/opensuse-updates/2014-03/msg00005.html http://www.debian.org/security/2014/dsa-2859 http://www.pidgin.im/news/security/?id=75 http://www.pidgin.im/news/security/?id=76 http://www.pidgin.im/news/security/?id=77 http://www.ubuntu.com/usn/USN-2100-1 https://rhn.redhat.com/errata/RHSA-2014-0139.html https://access.redhat.com/security/cve/CVE-2013-6482 https:/ • CWE-20: Improper Input Validation CWE-476: NULL Pointer Dereference •