CVE-2013-6483

2014-02-0500:00:00

ubuntu.com

6.4 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:N/I:P/A:P

0.019 Low

EPSS

Percentile

88.7%

JSON

The XMPP protocol plugin in libpurple in Pidgin before 2.10.8 does not
properly determine whether the from address in an iq reply is consistent
with the to address in an iq request, which allows remote attackers to
spoof iq traffic or cause a denial of service (NULL pointer dereference and
application crash) via a crafted reply.

Notes

Author	Note
mdeslaur	this introduced a regression, which was fixed in 2.10.9: https://developer.pidgin.im/ticket/15879

OSVersionArchitecturePackageVersionFilename
ubuntu12.04noarchpidgin< 1:2.10.3-0ubuntu1.4UNKNOWN
ubuntu12.10noarchpidgin< 1:2.10.6-0ubuntu2.3UNKNOWN
ubuntu13.10noarchpidgin< 1:2.10.7-0ubuntu4.1.13.10.1UNKNOWN

OS	Version	Architecture	Package	Version	Filename
ubuntu	12.04	noarch	pidgin	< 1:2.10.3-0ubuntu1.4	UNKNOWN
ubuntu	12.10	noarch	pidgin	< 1:2.10.6-0ubuntu2.3	UNKNOWN
ubuntu	13.10	noarch	pidgin	< 1:2.10.7-0ubuntu4.1.13.10.1	UNKNOWN