Design/Logic Flaw

2012-03-1510:55:00

PRIOn knowledge base

www.prio-n.com

6.9 Medium

AI Score

Confidence

High

5 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:N/I:N/A:P

0.012 Low

EPSS

Percentile

84.9%

JSON

The msn_oim_report_to_user function in oim.c in the MSN protocol plugin in libpurple in Pidgin before 2.10.2 allows remote servers to cause a denial of service (application crash) via an OIM message that lacks UTF-8 encoding.

CPENameOperatorVersion
pidgineq2.5.9
pidgineq2.5.8
pidgineq2.7.9
pidgineq2.7.5
pidgineq2.1.0
pidgineq2.7.4
pidgineq2.6.0
pidgineq2.5.2
pidgineq2.5.1
pidgineq2.6.3

Name	Operator	Version
pidgin	eq	2.5.9
pidgin	eq	2.5.8
pidgin	eq	2.7.9
pidgin	eq	2.7.5
pidgin	eq	2.1.0
pidgin	eq	2.7.4
pidgin	eq	2.6.0
pidgin	eq	2.5.2
pidgin	eq	2.5.1
pidgin	eq	2.6.3

Rows per page:

1-10 of 461

References

developer.pidgin.im/ticket/14884

developer.pidgin.im/viewmtn/revision/diff/60f8379d0a610538cf42e0dd9ab1436c8b9308cd/with/3053d6a37cc6d8774aba7607b992a4408216adcd/libpurple/protocols/msn/oim.c

developer.pidgin.im/viewmtn/revision/info/3053d6a37cc6d8774aba7607b992a4408216adcd

pidgin.im/news/security/?id=61

rhn.redhat.com/errata/RHSA-2012-1102.html

secunia.com/advisories/50005

www.mandriva.com/security/advisories?name=MDVSA-2012:029

www.securityfocus.com/bid/52475

oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A18019