CVE-2010-0013

Published Jan 9, 2010

Last updated 10 months ago

Overview

Description: Directory traversal vulnerability in slp.c in the MSN protocol plugin in libpurple in Pidgin 2.6.4 and Adium 1.3.8 allows remote attackers to read arbitrary files via a .. (dot dot) in an application/x-msnmsgrp2p MSN emoticon (aka custom smiley) request, a related issue to CVE-2004-0122. NOTE: it could be argued that this is resultant from a vulnerability in which an emoticon download request is processed even without a preceding text/x-mms-emoticon message that announced availability of the emoticon.
Source: secalert@redhat.com
NVD status: Analyzed

Hype score: Not currently trending

Risk scores

CVSS 3.1

Type: Primary
Base score: 7.5
Impact score: 3.6
Exploitability score: 3.9
Vector string: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Severity: HIGH

CVSS 2.0

Type: Primary
Base score: 5
Impact score: 2.9
Exploitability score: 10
Vector string: AV:N/AC:L/Au:N/C:P/I:N/A:N

Weaknesses

nvd@nist.gov: CWE-22

Configurations

[
  {
    "nodes": [
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:adium:adium:1.3.8:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "9BDD1A05-8C38-4787-ACF3-414D625F748F"
          },
          {
            "criteria": "cpe:2.3:a:pidgin:pidgin:2.6.4:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "4B11BCF7-3127-4B2E-967F-2B22A229592E"
          }
        ],
        "operator": "OR"
      }
    ]
  },
  {
    "nodes": [
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:o:fedoraproject:fedora:11:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "B3BB5EDB-520B-4DEF-B06E-65CA13152824"
          },
          {
            "criteria": "cpe:2.3:o:fedoraproject:fedora:12:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "E44669D7-6C1E-4844-B78A-73E253A7CC17"
          }
        ],
        "operator": "OR"
      }
    ]
  },
  {
    "nodes": [
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:o:opensuse:opensuse:*:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "9B9D5815-B269-4E63-8F37-E064B49EBF71",
            "versionEndIncluding": "11.2",
            "versionStartIncluding": "11.0"
          },
          {
            "criteria": "cpe:2.3:o:suse:linux_enterprise:11.0:-:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "1608E282-2E96-4447-848D-DBE915DB0EF9"
          },
          {
            "criteria": "cpe:2.3:o:suse:linux_enterprise_server:10:sp2:*:*:-:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "105187A7-2AFE-46F9-B0A9-F09C7E10BFBD"
          },
          {
            "criteria": "cpe:2.3:o:suse:linux_enterprise_server:10:sp3:*:*:-:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "79A35457-EAA3-4BF9-A4DA-B2E414A75A02"
          }
        ],
        "operator": "OR"
      }
    ]
  },
  {
    "nodes": [
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:o:redhat:enterprise_linux:4.0:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "6172AF57-B26D-45F8-BE3A-F75ABDF28F49"
          },
          {
            "criteria": "cpe:2.3:o:redhat:enterprise_linux:5.0:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "1D8B549B-E57B-4DFE-8A13-CAB06B5356B3"
          }
        ],
        "operator": "OR"
      }
    ]
  }
]

Overview

Social media

Risk scores

CVSS 3.1

CVSS 2.0

Weaknesses

Configurations

References