CVEvulnerability

CVE-2010-0013

7.5 HIGH Published 2010-01-09 Modified 2026-06-16 Official page ↗
Status
Modified
Published
2010-01-09
Last modified
2026-06-16
Assigner
[email protected]
CVSS 3.1 ([email protected])
7.5 HIGH — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS 2.0 ([email protected])
5.0 MEDIUM — AV:N/AC:L/Au:N/C:P/I:N/A:N
Weaknesses
CWE-22

Description

Directory traversal vulnerability in slp.c in the MSN protocol plugin in libpurple in Pidgin 2.6.4 and Adium 1.3.8 allows remote attackers to read arbitrary files via a .. (dot dot) in an application/x-msnmsgrp2p MSN emoticon (aka custom smiley) request, a related issue to CVE-2004-0122. NOTE: it could be argued that this is resultant from a vulnerability in which an emoticon download request is processed even without a preceding text/x-mms-emoticon message that announced availability of the emoticon.

Affected configurations

• adium adium 1.3.8 • pidgin pidgin 2.6.4 • fedoraproject fedora 11 • fedoraproject fedora 12 • opensuse opensuse (>= 11.0 <= 11.2) • suse linux enterprise 11.0 • suse linux enterprise server 10 • redhat enterprise linux 4.0 • redhat enterprise linux 5.0

Related

Weakness · CWE (1)

  • CWE-22 Improper Limitation of a Pathname to a Restricted Directory weakness

Referenced by CWE · observed example (1)

  • CWE-22 Improper Limitation of a Pathname to a Restricted Directory weakness

References