Nixpkgs security tracker
6.2 MEDIUM
- CVSS version (CVSS): 3.1
- Attack Vector (AV): Local (L)
- Attack Complexity (AC): Low (L)
- Privileges Required (PR): None (N)
- User Interaction (UI): None (N)
- Scope (S): Unchanged (U)
- Confidentiality (C): None (N)
- Integrity (I): None (N)
- Availability (A): High (H)
- Modified Attack Vector (MAV): Local (L)
- Modified Attack Complexity (MAC): Low (L)
- Modified Privileges Required (MPR): None (N)
- Modified User Interaction (MUI): None (N)
- Modified Confidentiality (MC): None (N)
- Modified Scope (MS): Unchanged (U)
- Modified Integrity (MI): None (N)
- Modified Availability (MA): High (H)
by @mweinelt Activity log
- Created suggestion
- @mweinelt dismissed
Pidgin 2.13.0 Denial of Service via Malformed Username
Pidgin 2.13.0 contains a denial of service vulnerability that allows local attackers to crash the application by providing an excessively long username string during account creation. Attackers can input a buffer of 1000 characters in the username field and trigger a crash when joining a chat, causing the application to become unavailable.
References
-
ExploitDB-46930 exploit
-
Official Product Homepage product
-
VulnCheck Advisory: Pidgin 2.13.0 Denial of Service via Malformed Username third-party-advisory
Affected products
- ==2.13.0
Matching in nixpkgs
pkgs.pidgin
Multi-protocol instant messaging client
pkgs.pidginPackages.pidgin
Multi-protocol instant messaging client
pkgs.pidginPackages.pidgin-mra
Mail.ru Agent plugin for Pidgin / libpurple
pkgs.pidginPackages.pidgin-osd
Plugin for Pidgin which implements on-screen display via libxosd
pkgs.pidginPackages.pidgin-otr
Plugin for Pidgin 2.x which implements OTR Messaging
pkgs.pidginPackages.pidgin-sipe
SIPE plugin for Pidgin IM
pkgs.pidginPackages.pidgin-latex
LaTeX rendering plugin for Pidgin IM
pkgs.pidginPackages.pidgin-carbons
XEP-0280: Message Carbons plugin for libpurple
pkgs.pidginPackages.pidgin-skypeweb
SkypeWeb plugin for Pidgin
pkgs.pidginPackages.pidgin-indicator
AppIndicator and KStatusNotifierItem Plugin for Pidgin
pkgs.pidginPackages.pidgin-msn-pecan
Alternative MSN protocol plug-in for Pidgin IM
pkgs.pidginPackages.pidgin-window-merge
Pidgin plugin that merges the Buddy List window with a conversation window
pkgs.pidginPackages.pidgin-xmpp-receipts
Message delivery receipts (XEP-0184) Pidgin plugin
pkgs.pidginPackages.pidgin-opensteamworks
Plugin for Pidgin 2.x which implements Steam Friends/Steam IM compatibility
Package maintainers
-
@lucasew Lucas Eduardo Wendt <lucas59356@gmail.com>
-
@colonelpanic8 Ivan Malison <IvanMalison@gmail.com>
-
@abbradar Nikolay Amiantov <ab@fmap.me>
-
@Shados Alexei Robyn <shados@shados.net>
-
@orivej Orivej Desh <orivej@gmx.fr>