Directory traversal vulnerability in slp.c in the MSN protocol plugin in libpurple in Pidgin 2.6.4 and Adium 1.3.8 allows remote attackers to read arbitrary files via a .. (dot dot) in an application/x-msnmsgrp2p MSN emoticon (aka custom smiley) request, a related issue to CVE-2004-0122. NOTE: it could be argued that this is resultant from a vulnerability in which an emoticon download request is processed even without a preceding text/x-mms-emoticon message that announced availability of the emoticon.
CVSS Details
- CVSS 3.1 Base Score: 7.5
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Centos_linux | — | Upgrade libpurple-perlUpgrade libpurple-develUpgrade finch-develUpgrade pidginUpgrade libpurple-tclUpgrade libpurpleUpgrade pidgin-perlUpgrade finchUpgrade pidgin-devel | Dec 1, 2016 | Jan 9, 2010 |
| Debian | — | Upgrade pidgin | Jul 30, 2024 | Jan 9, 2010 |
| Gentoo Linux | — | Upgrade net-im/pidgin. | Oct 30, 2017 | Jan 9, 2010 |
| Suse | — | Upgrade libpurple-develUpgrade libpurple-meanwhileUpgrade pidginUpgrade finchUpgrade pidgin-develUpgrade finch-develUpgrade libpurple-branding-upstreamUpgrade libpurple-langUpgrade libpurpleUpgrade libpurple-tclUpgrade libpurple-plugin-sametime | Feb 17, 2015 | Jun 28, 2013 |
| Ubuntu | — | Upgrade pidgin | Nov 8, 2024 | Jan 9, 2010 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub