PT-2013-2205 · Pidgin+3 · Libpurple+4

Publicado 2013-02-16 · Atualizado 2017-09-19 · CVE-2013-0272

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Média

Vetor base

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Pidgin versions prior to 2.10.7

Description The issue is related to a buffer overflow in the http.c file within the MXit protocol plugin in libpurple. This allows remote servers to execute arbitrary code via a long HTTP header.

Recommendations For versions prior to 2.10.7, update to version 2.10.7 or later to resolve the issue.

Correção

Buffer Overflow

Enumeração de Fraquezas

CWE-119

Identificadores relacionados

CESA-2013_0646

CVE-2013-0272

OPENSUSE-SU-2013_0405-1

OPENSUSE-SU-2013_0407-1

OPENSUSE-SU-2013_0511-1

OPENSUSE-SU-2024:10432-1

RHSA-2013:0646

RHSA-2013_0646

Produtos afetados

Centos

Pidgin

Red Hat

Suse

Libpurple

Referências · 34

• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-0274 · Nota de Segurança
• http://support.novell.com/security/cve/CVE-2013-0273.html · Nota
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A17474 · Nota
• http://pidgin.im/news/security/?id=66 · Aviso do Fabricante
• https://security-tracker.debian.org/tracker/CVE-2013-0272 · Aviso do Fabricante
• http://lists.opensuse.org/opensuse-security-announce/2013-03/msg00003.html · Aviso do Fabricante
• https://access.redhat.com/security/cve/CVE-2013-0273 · Nota
• https://lists.centos.org/pipermail/centos-announce/2013-March/056567.html · Nota
• http://hg.pidgin.im/pidgin/main/rev/879db2a9a59c · Nota
• https://lists.opensuse.org/archives/list/[e-mail]/thread/CX7VVDCMFZN3HXT5Y7EFD6SC4G7IMIYC · Nota
• http://securityfocus.com/bid/57951 · Nota
• http://lists.opensuse.org/opensuse-security-announce/2013-03/msg00006.html · Aviso do Fabricante
• http://lists.opensuse.org/opensuse-security-announce/2013-03/msg00007.html · Aviso do Fabricante
• https://lists.opensuse.org/archives/list/[e-mail]/thread/RBVILXI4CQCGIIYB3BZ7VT7EYH3A5FXE · Nota
• https://lists.centos.org/pipermail/centos-announce/2013-March/081810.html · Nota