CVSS: 6.8EPSS: 1%CPEs: 51EXPL: 0CVE-2013-0272 – pidgin: MXit protocol stack-based buffer overflow when processing HTTP headers
https://notcve.org/view.php?id=CVE-2013-0272
Buffer overflow in http.c in the MXit protocol plugin in libpurple in Pidgin before 2.10.7 allows remote servers to execute arbitrary code via a long HTTP header. Desbordamiento de búfer en http.c en el plugin de protocolo MXit en libpurple en Pidgin anteiror a v2.10.7 permite a servidores remotos ejecutar código mediante un header HTTP de gran longitud. • http://hg.pidgin.im/pidgin/main/rev/879db2a9a59c http://lists.opensuse.org/opensuse-security-announce/2013-03/msg00003.html http://lists.opensuse.org/opensuse-security-announce/2013-03/msg00006.html http://lists.opensuse.org/opensuse-security-announce/2013-03/msg00007.html http://www.pidgin.im/news/security/?id=66 http://www.securityfocus.com/bid/57951 http://www.ubuntu.com/usn/USN-1746-1 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A17474 htt • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer CWE-121: Stack-based Buffer Overflow •
CVSS: 5.0EPSS: 0%CPEs: 51EXPL: 0CVE-2013-0273 – pidgin: Meanwhile protocol missing nul termination of long Lotus Sametime usernames
https://notcve.org/view.php?id=CVE-2013-0273
sametime.c in the Sametime protocol plugin in libpurple in Pidgin before 2.10.7 does not properly terminate long user IDs, which allows remote servers to cause a denial of service (application crash) via a crafted packet. sametime.c en el plugin de protocolo Sametime en libpurple en Pidgin anterior a v2.10.7 no termina correctamente IDs de usuario de gran longitud, permitiendo a servidores remotos causar una denegación de servicio (caída de la aplicación) mediante un paquete manipulado. • http://hg.pidgin.im/pidgin/main/rev/c31cf8de31cd http://lists.opensuse.org/opensuse-security-announce/2013-03/msg00003.html http://lists.opensuse.org/opensuse-security-announce/2013-03/msg00006.html http://lists.opensuse.org/opensuse-security-announce/2013-03/msg00007.html http://www.pidgin.im/news/security/?id=67 http://www.ubuntu.com/usn/USN-1746-1 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A18340 https://access.redhat.com/security/cve/CV •
CVSS: 2.1EPSS: 0%CPEs: 45EXPL: 1CVE-2011-4922 – Cipher API information disclosure in pidgin
https://notcve.org/view.php?id=CVE-2011-4922
cipher.c in the Cipher API in libpurple in Pidgin before 2.7.10 retains encryption-key data in process memory, which might allow local users to obtain sensitive information by reading a core file or other representation of memory contents. cipher.c en la API de cifrado en libpurple en Pidgin anterior a v2.7.10 conserva la clave de cifrado de datos en la memoria del proceso, lo que podría permitir a usuarios locales obtener información sensible mediante la lectura de un archivo central u otra representación de contenido de la memoria. • http://hg.pidgin.im/pidgin/main/rev/8c850977cb42 http://openwall.com/lists/oss-security/2012/01/04/13 http://www.pidgin.im/news/security/?id=50 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A18223 https://access.redhat.com/security/cve/CVE-2011-4922 https://bugzilla.redhat.com/show_bug.cgi?id=684685 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 7.5EPSS: 28%CPEs: 49EXPL: 1CVE-2012-3374 – pidgin: Stack-based buffer overwrite in MXit protocol libPurple plug-in
https://notcve.org/view.php?id=CVE-2012-3374
Buffer overflow in markup.c in the MXit protocol plugin in libpurple in Pidgin before 2.10.5 allows remote attackers to execute arbitrary code via a crafted inline image in a message. Desbordamiento de búfer basado en pila en markup.c en el plugin MXit en libpurple en Pidgin anterior a v2.10.5 permite a atacantes remotos ejecutar código de su elección a través de una imagen en un mensaje • http://hg.pidgin.im/pidgin/main/rev/ded93865ef42 http://lists.opensuse.org/opensuse-security-announce/2012-07/msg00009.html http://rhn.redhat.com/errata/RHSA-2012-1102.html http://secunia.com/advisories/50005 http://www.mandriva.com/security/advisories?name=MDVSA-2012:105 http://www.pidgin.im/news/security/index.php?id=64 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A17678 https://access.redhat.com/security/cve/CVE-2012-3374 https://bugzi • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 3.5EPSS: 0%CPEs: 48EXPL: 0CVE-2012-2214
https://notcve.org/view.php?id=CVE-2012-2214
proxy.c in libpurple in Pidgin before 2.10.4 does not properly handle canceled SOCKS5 connection attempts, which allows user-assisted remote authenticated users to cause a denial of service (application crash) via a sequence of XMPP file-transfer requests. proxy.c en libpurple en Pidgin anteriores a v2.10.4 no gestiona de forma adecuada los intentos de conexión SOCKS5 cancelados, lo oque permite a usuarios remotos asistidos por usuario autenticados a provocar una denegación de servicio (caída de aplicación) a través de una secuencia de peticiones de transferencia de ficheros XMPP. • http://hg.pidgin.im/pidgin/main/rev/5f9d676cefdb http://pidgin.im/news/security/?id=62 http://www.mandriva.com/security/advisories?name=MDVSA-2012:082 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A17886 • CWE-399: Resource Management Errors •