CVSS: 5.0EPSS: 3%CPEs: 53EXPL: 0CVE-2013-6477 – pidgin: DoS when handling timestamps in the XMPP plugin
https://notcve.org/view.php?id=CVE-2013-6477
Multiple integer signedness errors in libpurple in Pidgin before 2.10.8 allow remote attackers to cause a denial of service (application crash) via a crafted timestamp value in an XMPP message. Múltiples errores de signo de enteros en libpurple en Pidgin anterior a 2.10.8 permiten a atacantes remotos causar una denegación de servicio (caída de la aplicación) a través de un valor timestamp manipulado en un mensaje XMPP. • http://hg.pidgin.im/pidgin/main/rev/852014ae74a0 http://lists.opensuse.org/opensuse-updates/2014-02/msg00039.html http://lists.opensuse.org/opensuse-updates/2014-03/msg00005.html http://pidgin.im/news/security/?id=71 http://www.debian.org/security/2014/dsa-2859 http://www.ubuntu.com/usn/USN-2100-1 https://rhn.redhat.com/errata/RHSA-2014-0139.html https://access.redhat.com/security/cve/CVE-2013-6477 https://bugzilla.redhat.com/show_bug.cgi?id=1056479 • CWE-189: Numeric Errors CWE-190: Integer Overflow or Wraparound •
CVSS: 7.5EPSS: 2%CPEs: 14EXPL: 0CVE-2013-6487 – pidgin: Heap-based buffer overflow in Gadu-Gadu protocol plugin
https://notcve.org/view.php?id=CVE-2013-6487
Integer overflow in libpurple/protocols/gg/lib/http.c in the Gadu-Gadu (gg) parser in Pidgin before 2.10.8 allows remote attackers to have an unspecified impact via a large Content-Length value, which triggers a buffer overflow. Desbordamiento de entero en libpurple/protocols/gg/lib/http.c en el analizador Gadu-Gadu (gg) en Pidgin anterior a 2.10.8 permite a atacantes remotos tener un impacto no especificado a través de un valor Content-Length largo, lo que provoca un desbordamiento de buffer. • http://advisories.mageia.org/MGASA-2014-0074.html http://hg.pidgin.im/pidgin/main/rev/ec15aa187aa0 http://libgadu.net/releases/1.11.3.html http://lists.fedoraproject.org/pipermail/package-announce/2014-February/128277.html http://lists.opensuse.org/opensuse-updates/2014-02/msg00039.html http://lists.opensuse.org/opensuse-updates/2014-03/msg00005.html http://vrt-blog.snort.org/2014/01/vrt-2013-1001-cve-2013-6487-buffer.html http://www.debian.org/security/2014/dsa-2852 http: • CWE-122: Heap-based Buffer Overflow CWE-189: Numeric Errors •
CVSS: 5.0EPSS: 3%CPEs: 53EXPL: 0CVE-2013-6481 – pidgin: DoS caused due to OOB read in Yahoo protocol plugin
https://notcve.org/view.php?id=CVE-2013-6481
libpurple/protocols/yahoo/libymsg.c in Pidgin before 2.10.8 allows remote attackers to cause a denial of service (crash) via a Yahoo! P2P message with a crafted length field, which triggers a buffer over-read. libpurple/protocols/yahoo/libymsg.c en Pidgin anterior a 2.10.8 permite a atacantes remotos causar una denegación de servicio (caída) a través de un mensaje Yahoo! P2P con un campo "length" manipulado, lo que provoca una sobre-lectura del buffer. • http://hg.pidgin.im/pidgin/main/rev/4d139ce8f7ec http://lists.opensuse.org/opensuse-updates/2014-02/msg00039.html http://lists.opensuse.org/opensuse-updates/2014-03/msg00005.html http://www.debian.org/security/2014/dsa-2859 http://www.pidgin.im/news/security/?id=74 http://www.ubuntu.com/usn/USN-2100-1 https://rhn.redhat.com/errata/RHSA-2014-0139.html https://access.redhat.com/security/cve/CVE-2013-6481 https://bugzilla.redhat.com/show_bug.cgi?id=1056908 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer CWE-125: Out-of-bounds Read •
CVSS: 6.8EPSS: 1%CPEs: 51EXPL: 0CVE-2013-0272 – pidgin: MXit protocol stack-based buffer overflow when processing HTTP headers
https://notcve.org/view.php?id=CVE-2013-0272
Buffer overflow in http.c in the MXit protocol plugin in libpurple in Pidgin before 2.10.7 allows remote servers to execute arbitrary code via a long HTTP header. Desbordamiento de búfer en http.c en el plugin de protocolo MXit en libpurple en Pidgin anteiror a v2.10.7 permite a servidores remotos ejecutar código mediante un header HTTP de gran longitud. • http://hg.pidgin.im/pidgin/main/rev/879db2a9a59c http://lists.opensuse.org/opensuse-security-announce/2013-03/msg00003.html http://lists.opensuse.org/opensuse-security-announce/2013-03/msg00006.html http://lists.opensuse.org/opensuse-security-announce/2013-03/msg00007.html http://www.pidgin.im/news/security/?id=66 http://www.securityfocus.com/bid/57951 http://www.ubuntu.com/usn/USN-1746-1 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A17474 htt • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer CWE-121: Stack-based Buffer Overflow •
CVSS: 5.0EPSS: 0%CPEs: 51EXPL: 0CVE-2013-0271
https://notcve.org/view.php?id=CVE-2013-0271
The MXit protocol plugin in libpurple in Pidgin before 2.10.7 might allow remote attackers to create or overwrite files via a crafted (1) mxit or (2) mxit/imagestrips pathname. El plugin de protocolo MXit en libpurple en Pidgin anterior a v2.10.7 puede permitir a atacantes remotos sobreescribir ficheros mediante una ruta (1) mxit o (2) mxit/imagestrips • http://hg.pidgin.im/pidgin/main/rev/a8aef1d340f2 http://lists.opensuse.org/opensuse-security-announce/2013-03/msg00003.html http://lists.opensuse.org/opensuse-security-announce/2013-03/msg00006.html http://www.pidgin.im/news/security/?id=65 http://www.ubuntu.com/usn/USN-1746-1 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A18386 •