CVE-2014-3697 Absolute path traversal vulnerability in the untar_block function in win32/untar.c in Pidgin before 2.10.10 on Windows allows remote attackers to write to arbitrary files via a drive name in a tar arc...
MediumCVSS 6.4
EPSS 3.8%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Absolute path traversal vulnerability in the untar_block function in win32/untar.c in Pidgin before 2.10.10 on Windows allows remote attackers to write to arbitrary files via a drive name in a tar archive of a smiley theme.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| pidgin | <= 2.10.9 | No fix listed |
| pidgin | = 2.10.0 | No fix listed |
| pidgin | = 2.10.1 | No fix listed |
| pidgin | = 2.10.2 | No fix listed |
| pidgin | = 2.10.3 | No fix listed |
| pidgin | = 2.10.4 | No fix listed |
| pidgin | = 2.10.5 | No fix listed |
| pidgin | = 2.10.6 | No fix listed |
| pidgin | = 2.10.7 | No fix listed |
| pidgin | = 2.10.8 | No fix listed |
References
- hg.pidgin.im patch
- openSUSE-SU-2014:1376 vendor-advisory
- openSUSE-SU-2014:1397 vendor-advisory
- pidgin.im patch vendor-advisory
- Debian Security Tracker CVE-2014-3697 vendor-advisory