CVE-2010-0013

high-risk
Published 2010-01-09

Directory traversal vulnerability in slp.c in the MSN protocol plugin in libpurple in Pidgin 2.6.4 and Adium 1.3.8 allows remote attackers to read arbitrary files via a .. (dot dot) in an application/x-msnmsgrp2p MSN emoticon (aka custom smiley) request, a related issue to CVE-2004-0122. NOTE: it could be argued that this is resultant from a vulnerability in which an emoticon download request is processed even without a preceding text/x-mms-emoticon message that announced availability of the emoticon.

Do I need to act?

!
12.8% chance of exploitation in next 30 days
EPSS score — higher than 87% of all CVEs
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
!
1 public exploit available
11203
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
7
CVSS 7.5/10 High
NETWORK / LOW complexity

Affected Products (10)

Affected Vendors

Opensuse Redhat Pidgin Fedoraproject Adium Suse

References (48)

Broken Link http://d.pidgin.im/viewmtn/revision/info/3d02401cf232459fc80c0837d31e05fae7ae546...
Broken Link http://d.pidgin.im/viewmtn/revision/info/4be2df4f72bd8a55cdae7f2554b73342a497c92...
Broken Link http://d.pidgin.im/viewmtn/revision/info/c64a1adc8bda2b4aeaae1f273541afbc4f71b81...
Broken Link http://developer.pidgin.im/viewmtn/revision/diff/3d02401cf232459fc80c0837d31e05f...
Product http://events.ccc.de/congress/2009/Fahrplan/events/3596.en.html
Mailing List http://lists.fedoraproject.org/pipermail/package-announce/2010-January/033771.ht...
Mailing List http://lists.fedoraproject.org/pipermail/package-announce/2010-January/033848.ht...
Mailing List http://lists.opensuse.org/opensuse-security-announce/2010-03/msg00004.html
Broken Link http://secunia.com/advisories/37953
Broken Link http://secunia.com/advisories/37954
Broken Link http://secunia.com/advisories/37961
Broken Link http://secunia.com/advisories/38915
Broken Link http://sunsolve.sun.com/search/document.do?assetkey=1-66-277450-1
Broken Link http://sunsolve.sun.com/search/document.do?assetkey=1-77-1022203.1-1
Broken Link http://www.mandriva.com/security/advisories?name=MDVSA-2010:085
Mailing List http://www.openwall.com/lists/oss-security/2010/01/02/1
Mailing List http://www.openwall.com/lists/oss-security/2010/01/07/1
Mailing List http://www.openwall.com/lists/oss-security/2010/01/07/2
Permissions Required http://www.vupen.com/english/advisories/2009/3662
Permissions Required http://www.vupen.com/english/advisories/2009/3663
and 28 more references
61
/ 100
high-risk
Severity 26/34 · High
Exploitability 19/34 · Moderate
Exposure 16/34 · Moderate