CVE-2010-0013
Fixed in a distro release EPSS 12%
Directory traversal vulnerability in slp.c in the MSN protocol plugin in libpurple in Pidgin 2.6.4 and Adium 1.3.8 allows remote attackers to read arbitrary files via a .. (dot dot) in an application/x-msnmsgrp2p MSN emoticon (aka custom smiley) request, a related issue to CVE-2004-0122. NOTE: it could be argued that this is resultant from a vulnerability in which an emoticon download request is processed even without a preceding text/x-mms-emoticon message that announced availability of the emoticon.
Products: adium, pidgin, fedoraproject fedora, opensuse, suse linux_enterprise, suse linux_enterprise_server, redhat enterprise_linux
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 12 | pidgin | 2.6.5-1 |
| Debian 13 | pidgin | 2.6.5-1 |
| Debian 14 | pidgin | 2.6.5-1 |
| Red Hat Enterprise Linux 4 | finch | 0:2.6.5-1.el4.1 |
| Red Hat Enterprise Linux 4 | finch-devel | 0:2.6.5-1.el4.1 |
| Red Hat Enterprise Linux 4 | libpurple | 0:2.6.5-1.el4.1 |
| Red Hat Enterprise Linux 4 | libpurple-devel | 0:2.6.5-1.el4.1 |
| Red Hat Enterprise Linux 4 | libpurple-perl | 0:2.6.5-1.el4.1 |
| Red Hat Enterprise Linux 4 | libpurple-tcl | 0:2.6.5-1.el4.1 |
| Red Hat Enterprise Linux 4 | pidgin | 0:2.6.5-1.el4.1 |
| Red Hat Enterprise Linux 4 | pidgin-debuginfo | 0:2.6.5-1.el4.1 |
| Red Hat Enterprise Linux 4 | pidgin-devel | 0:2.6.5-1.el4.1 |
| Red Hat Enterprise Linux 4 | pidgin-perl | 0:2.6.5-1.el4.1 |
| Red Hat Enterprise Linux 5 | finch | 0:2.6.5-1.el5 |
| Red Hat Enterprise Linux 5 | finch-devel | 0:2.6.5-1.el5 |
| Red Hat Enterprise Linux 5 | libpurple | 0:2.6.5-1.el5 |
| Red Hat Enterprise Linux 5 | libpurple-devel | 0:2.6.5-1.el5 |
| Red Hat Enterprise Linux 5 | libpurple-perl | 0:2.6.5-1.el5 |
| Red Hat Enterprise Linux 5 | libpurple-tcl | 0:2.6.5-1.el5 |
| Red Hat Enterprise Linux 5 | pidgin | 0:2.6.5-1.el5 |
| Red Hat Enterprise Linux 5 | pidgin-debuginfo | 0:2.6.5-1.el5 |
| Red Hat Enterprise Linux 5 | pidgin-devel | 0:2.6.5-1.el5 |
| Red Hat Enterprise Linux 5 | pidgin-perl | 0:2.6.5-1.el5 |
| Red Hat rhel productivity 5 | finch | 0:2.6.5-1.el5 |
| Red Hat rhel productivity 5 | finch-devel | 0:2.6.5-1.el5 |
| Red Hat rhel productivity 5 | libpurple | 0:2.6.5-1.el5 |
| Red Hat rhel productivity 5 | libpurple-devel | 0:2.6.5-1.el5 |
| Red Hat rhel productivity 5 | libpurple-perl | 0:2.6.5-1.el5 |
| Red Hat rhel productivity 5 | libpurple-tcl | 0:2.6.5-1.el5 |
| Red Hat rhel productivity 5 | pidgin | 0:2.6.5-1.el5 |
| Red Hat rhel productivity 5 | pidgin-debuginfo | 0:2.6.5-1.el5 |
| Red Hat rhel productivity 5 | pidgin-devel | 0:2.6.5-1.el5 |
| Red Hat rhel productivity 5 | pidgin-perl | 0:2.6.5-1.el5 |