Improper input validation in Pidgin Libpurple
CVE-2010-4528
directconn.c in the MSN protocol plugin in libpurple 2.7.6 through 2.7.8 in Pidgin before 2.7.9 allows remote authenticated users to cause a denial of service (NULL pointer dereference and application crash) via a short p2pv2 packet in a DirectConnect (aka direct connection) session.
Vulnerability class: Drupalgeddon 2 (CVE-2018-7600)
Published · last modified .
CVSS v2 metric
CVSS v2 base score 4.0 (Medium). Vector: AV:N/AC:L/Au:S/C:N/I:N/A:P. This CVE predates CVSS v3 and has no v3 score from NVD.
EPSS exploit prediction
EPSS: 0.025 (84.4th percentile), scored .
Low probability of exploitation in the next 30 days, but still tracked. 84th percentile — 84.4% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.025 · newest: 0.025 · change: 0.000
Affected products
- Pidgin Libpurple — versions 2.7.7, 2.7.8, 2.7.6
- Pidgin — versions 2.7.4, 2.7.1, 2.5.1
Weakness classification (CWE)
References
- bugzilla.redhat.com/show_bug.cgi
- lists.opensuse.org/opensuse-security-announce/2011-01/msg00003.html (vendor-advisory)
- www.openwall.com/lists/oss-security/2010/12/27/1 (mailing-list, Patch)
- developer.pidgin.im/viewmtn/revision/diff/e76f4ad4ef2f10588195a0eedc7a08f82062f… (Patch)
- www.openwall.com/lists/oss-security/2010/12/31/5 (mailing-list, Patch)
- www.pidgin.im/news/security/ (Patch, Vendor Advisory)
- www.mandriva.com/security/advisories (vendor-advisory)
- oval.cisecurity.org/repository/search/definition/oval:org.mitre.oval:def:18461 (signature, vdb-entry)
- developer.pidgin.im/viewmtn/revision/info/aaa07bde3c51d3684391ae6ed86b6dbaeab5d… (Patch)
- www.securityfocus.com/bid/45581 (vdb-entry)