CVSS: 4.3EPSS: 1%CPEs: 51EXPL: 0CVE-2013-0274 – pidgin: missing nul termination of long values in UPnP responses
https://notcve.org/view.php?id=CVE-2013-0274
upnp.c in libpurple in Pidgin before 2.10.7 does not properly terminate long strings in UPnP responses, which allows remote attackers to cause a denial of service (application crash) by leveraging access to the local network. upnp.c en libpurple en Pidgin anterior a v2.10.7 no termina correctamente string de gran longitud en respuestas UPnP, permitiendo a atacantes remotos causar una denegación de servicio (caída de la aplicación) mediante el acceso a un red local. • http://hg.pidgin.im/pidgin/main/rev/ad7e7fb98db3 http://lists.opensuse.org/opensuse-security-announce/2013-03/msg00003.html http://lists.opensuse.org/opensuse-security-announce/2013-03/msg00006.html http://lists.opensuse.org/opensuse-security-announce/2013-03/msg00007.html http://www.pidgin.im/news/security/?id=68 http://www.ubuntu.com/usn/USN-1746-1 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A18221 https://access.redhat.com/security/cve/CV •
CVSS: 5.0EPSS: 0%CPEs: 51EXPL: 0CVE-2013-0273 – pidgin: Meanwhile protocol missing nul termination of long Lotus Sametime usernames
https://notcve.org/view.php?id=CVE-2013-0273
sametime.c in the Sametime protocol plugin in libpurple in Pidgin before 2.10.7 does not properly terminate long user IDs, which allows remote servers to cause a denial of service (application crash) via a crafted packet. sametime.c en el plugin de protocolo Sametime en libpurple en Pidgin anterior a v2.10.7 no termina correctamente IDs de usuario de gran longitud, permitiendo a servidores remotos causar una denegación de servicio (caída de la aplicación) mediante un paquete manipulado. • http://hg.pidgin.im/pidgin/main/rev/c31cf8de31cd http://lists.opensuse.org/opensuse-security-announce/2013-03/msg00003.html http://lists.opensuse.org/opensuse-security-announce/2013-03/msg00006.html http://lists.opensuse.org/opensuse-security-announce/2013-03/msg00007.html http://www.pidgin.im/news/security/?id=67 http://www.ubuntu.com/usn/USN-1746-1 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A18340 https://access.redhat.com/security/cve/CV •
CVSS: 5.0EPSS: 0%CPEs: 51EXPL: 0CVE-2013-0271
https://notcve.org/view.php?id=CVE-2013-0271
The MXit protocol plugin in libpurple in Pidgin before 2.10.7 might allow remote attackers to create or overwrite files via a crafted (1) mxit or (2) mxit/imagestrips pathname. El plugin de protocolo MXit en libpurple en Pidgin anterior a v2.10.7 puede permitir a atacantes remotos sobreescribir ficheros mediante una ruta (1) mxit o (2) mxit/imagestrips • http://hg.pidgin.im/pidgin/main/rev/a8aef1d340f2 http://lists.opensuse.org/opensuse-security-announce/2013-03/msg00003.html http://lists.opensuse.org/opensuse-security-announce/2013-03/msg00006.html http://www.pidgin.im/news/security/?id=65 http://www.ubuntu.com/usn/USN-1746-1 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A18386 •
CVSS: 6.8EPSS: 1%CPEs: 51EXPL: 0CVE-2013-0272 – pidgin: MXit protocol stack-based buffer overflow when processing HTTP headers
https://notcve.org/view.php?id=CVE-2013-0272
Buffer overflow in http.c in the MXit protocol plugin in libpurple in Pidgin before 2.10.7 allows remote servers to execute arbitrary code via a long HTTP header. Desbordamiento de búfer en http.c en el plugin de protocolo MXit en libpurple en Pidgin anteiror a v2.10.7 permite a servidores remotos ejecutar código mediante un header HTTP de gran longitud. • http://hg.pidgin.im/pidgin/main/rev/879db2a9a59c http://lists.opensuse.org/opensuse-security-announce/2013-03/msg00003.html http://lists.opensuse.org/opensuse-security-announce/2013-03/msg00006.html http://lists.opensuse.org/opensuse-security-announce/2013-03/msg00007.html http://www.pidgin.im/news/security/?id=66 http://www.securityfocus.com/bid/57951 http://www.ubuntu.com/usn/USN-1746-1 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A17474 htt • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer CWE-121: Stack-based Buffer Overflow •
CVSS: 2.1EPSS: 0%CPEs: 45EXPL: 1CVE-2011-4922 – Cipher API information disclosure in pidgin
https://notcve.org/view.php?id=CVE-2011-4922
cipher.c in the Cipher API in libpurple in Pidgin before 2.7.10 retains encryption-key data in process memory, which might allow local users to obtain sensitive information by reading a core file or other representation of memory contents. cipher.c en la API de cifrado en libpurple en Pidgin anterior a v2.7.10 conserva la clave de cifrado de datos en la memoria del proceso, lo que podría permitir a usuarios locales obtener información sensible mediante la lectura de un archivo central u otra representación de contenido de la memoria. • http://hg.pidgin.im/pidgin/main/rev/8c850977cb42 http://openwall.com/lists/oss-security/2012/01/04/13 http://www.pidgin.im/news/security/?id=50 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A18223 https://access.redhat.com/security/cve/CVE-2011-4922 https://bugzilla.redhat.com/show_bug.cgi?id=684685 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •