CVSS: 5.0EPSS: 0%CPEs: 53EXPL: 0CVE-2013-6479 – pidgin: DoS when parsing certain HTTP response headers
https://notcve.org/view.php?id=CVE-2013-6479
util.c in libpurple in Pidgin before 2.10.8 does not properly allocate memory for HTTP responses that are inconsistent with the Content-Length header, which allows remote HTTP servers to cause a denial of service (application crash) via a crafted response. util.c en libpurple en Pidgin anterior a 2.10.8 no reserva correctamente la memoria para las respuestas HTTP que son inconsistentes con la cabecera Content-Length, lo que permite a servidores HTTP remotos causar una denegación de servicio (caída de la aplicación) a través de una respuesta manipulada. • http://hg.pidgin.im/pidgin/main/rev/cd529e1158d3 http://lists.opensuse.org/opensuse-updates/2014-02/msg00039.html http://lists.opensuse.org/opensuse-updates/2014-03/msg00005.html http://pidgin.im/news/security/?id=73 http://www.debian.org/security/2014/dsa-2859 http://www.ubuntu.com/usn/USN-2100-1 https://rhn.redhat.com/errata/RHSA-2014-0139.html https://access.redhat.com/security/cve/CVE-2013-6479 https://bugzilla.redhat.com/show_bug.cgi?id=1056907 • CWE-399: Resource Management Errors •
CVSS: 5.0EPSS: 1%CPEs: 53EXPL: 0CVE-2014-0020 – pidgin: DoS in IRC protocol plugin due to arguement parsing
https://notcve.org/view.php?id=CVE-2014-0020
The IRC protocol plugin in libpurple in Pidgin before 2.10.8 does not validate argument counts, which allows remote IRC servers to cause a denial of service (application crash) via a crafted message. El plugin del protocolo IRC en libpurple en Pidgin anterior a 2.10.8 no valida la cantidad de argumentos, lo que permite a servidores IRC remotos causar una denegación de servicio (caída de la aplicación) a través de un mensaje manipulado. • http://hg.pidgin.im/pidgin/main/rev/4d9be297d399 http://hg.pidgin.im/pidgin/main/rev/5845d9fa7084 http://hg.pidgin.im/pidgin/main/rev/6b0e0566af20 http://hg.pidgin.im/pidgin/main/rev/7d0fb0c6d8d4 http://hg.pidgin.im/pidgin/main/rev/9f132a6855cd http://hg.pidgin.im/pidgin/main/rev/a167504359e5 http://lists.opensuse.org/opensuse-updates/2014-02/msg00039.html http://lists.opensuse.org/opensuse-updates/2014-03/msg00005.html http://pidgin.im/news/security/?id=85 http:&# • CWE-20: Improper Input Validation CWE-628: Function Call with Incorrectly Specified Arguments •
CVSS: 9.3EPSS: 1%CPEs: 53EXPL: 0CVE-2013-6486
https://notcve.org/view.php?id=CVE-2013-6486
gtkutils.c in Pidgin before 2.10.8 on Windows allows user-assisted remote attackers to execute arbitrary programs via a message containing a file: URL that is improperly handled during construction of an explorer.exe command. NOTE: this vulnerability exists because of an incomplete fix for CVE-2011-3185. gtkutils.c en Pidgin anterior a 2.10.8 en Windows permite a atacantes remotos asistidos por usuario ejecutar programas arbitrarios a través de un mensaje que contenga un archivo: URL que no es manejada debidamente durante la construcción de un comando de explorer.exe. NOTA: esta vulnerabilidad existe debido a una correción incompleta para CVE-2011-3185. • http://hg.pidgin.im/pidgin/main/rev/b2571530fa8b http://lists.opensuse.org/opensuse-updates/2014-02/msg00039.html http://lists.opensuse.org/opensuse-updates/2014-03/msg00005.html http://pidgin.im/news/security/?id=81 http://www.securityfocus.com/bid/65189 • CWE-20: Improper Input Validation •
CVSS: 5.0EPSS: 0%CPEs: 53EXPL: 0CVE-2013-6484 – pidgin: DoS via specially-crafted stun messages
https://notcve.org/view.php?id=CVE-2013-6484
The STUN protocol implementation in libpurple in Pidgin before 2.10.8 allows remote STUN servers to cause a denial of service (out-of-bounds write operation and application crash) by triggering a socket read error. La implementación del protocolo STUN en libpurple en Pidgin anterior a 2.10.8 permite a servidores STUN remotos causar una denegación de servicio (una operación de escritura fuera de rango y caída de la aplicación) mediante un error de lectura del socket. • http://hg.pidgin.im/pidgin/main/rev/932b985540e9 http://lists.opensuse.org/opensuse-updates/2014-02/msg00039.html http://lists.opensuse.org/opensuse-updates/2014-03/msg00005.html http://pidgin.im/news/security/?id=79 http://www.debian.org/security/2014/dsa-2859 http://www.ubuntu.com/usn/USN-2100-1 https://rhn.redhat.com/errata/RHSA-2014-0139.html https://access.redhat.com/security/cve/CVE-2013-6484 https://bugzilla.redhat.com/show_bug.cgi?id=1057481 • CWE-20: Improper Input Validation CWE-190: Integer Overflow or Wraparound •
CVSS: 10.0EPSS: 1%CPEs: 53EXPL: 1CVE-2013-6490 – pidgin: Heap-based buffer overflow in SIMPLE protocol plugin
https://notcve.org/view.php?id=CVE-2013-6490
The SIMPLE protocol functionality in Pidgin before 2.10.8 allows remote attackers to have an unspecified impact via a negative Content-Length header, which triggers a buffer overflow. La funcionalidad del protocolo SIMPLE en Pidgin anterior a 2.10.8 permite a atacantes remotos tener un impacto no especificado a través de una cabecera Content-Length negativo, lo que provoca un desbordamiento de buffer. • https://github.com/Everdoh/CVE-2013-6490 http://hg.pidgin.im/pidgin/main/rev/6bd2dd10e5da http://www.debian.org/security/2014/dsa-2859 http://www.pidgin.im/news/security/?id=84 http://www.securityfocus.com/bid/65195 http://www.ubuntu.com/usn/USN-2100-1 https://rhn.redhat.com/errata/RHSA-2014-0139.html https://access.redhat.com/security/cve/CVE-2013-6490 https://bugzilla.redhat.com/show_bug.cgi?id=1057498 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer CWE-122: Heap-based Buffer Overflow •