CVE-2013-6487 Integer overflow in libpurple/protocols/gg/lib/http.c in the Gadu-Gadu (gg) parser in Pidgin before 2.10.8 allows remote attackers to have an unspecified impact via a large Content-Length value, which...
HighCVSS 7.5
EPSS 8.2%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Integer overflow in libpurple/protocols/gg/lib/http.c in the Gadu-Gadu (gg) parser in Pidgin before 2.10.8 allows remote attackers to have an unspecified impact via a large Content-Length value, which triggers a buffer overflow.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/libgadu(Debian:12) | < 1:1.11.3-1 | 1:1.11.3-1 |
| debian/libgadu(Debian:13) | < 1:1.11.3-1 | 1:1.11.3-1 |
| debian/libgadu(Debian:14) | < 1:1.11.3-1 | 1:1.11.3-1 |
| debian/pidgin(Debian:12) | < 2.10.8-1 | 2.10.8-1 |
| debian/pidgin(Debian:13) | < 2.10.8-1 | 2.10.8-1 |
| debian/pidgin(Debian:14) | < 2.10.8-1 | 2.10.8-1 |
| pidgin | <= 2.10.7 | No fix listed |
| pidgin | = 2.0.0 | No fix listed |
| pidgin | = 2.0.1 | No fix listed |
| pidgin | = 2.0.2 | No fix listed |
| pidgin | = 2.1.0 | No fix listed |
| pidgin | = 2.1.1 | No fix listed |
| pidgin | = 2.10.0 | No fix listed |
| pidgin | = 2.10.1 | No fix listed |
| pidgin | = 2.10.2 | No fix listed |
| pidgin | = 2.10.3 | No fix listed |
| pidgin | = 2.10.4 | No fix listed |
| pidgin | = 2.10.5 | No fix listed |
| pidgin | = 2.10.6 | No fix listed |
References
- Debian Security Tracker CVE-2013-6487 vendor-advisory
- advisories.mageia.org
- hg.pidgin.im vendor-advisory
- libgadu.net
- FEDORA-2014-2391 vendor-advisory
- openSUSE-SU-2014:0239 vendor-advisory
- openSUSE-SU-2014:0326 vendor-advisory
- vrt-blog.snort.org
- DSA-2852 vendor-advisory
- DSA-2859 vendor-advisory
- MDVSA-2014:039 vendor-advisory
- www.pidgin.im vendor-advisory
- 65188 vdb-entry
- USN-2100-1 vendor-advisory
- USN-2101-1 vendor-advisory
- RHSA-2014:0139 vendor-advisory
- GLSA-201508-02 vendor-advisory