National Cyber Awareness System

Vulnerability Summary for CVE-2010-0420

Overview

libpurple in Finch in Pidgin before 2.6.6, when an XMPP multi-user chat (MUC) room is used, does not properly parse nicknames containing <br> sequences, which allows remote attackers to cause a denial of service (application crash) via a crafted nickname.

Impact

CVSS Severity (version 2.0):

CVSS Version 2 Metrics:

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to nvd@nist.gov.

External Source: VUPEN

Name: ADV-2010-0413

Type: Advisory; Patch Information

Hyperlink:http://www.vupen.com/english/advisories/2010/0413

External Source: CONFIRM

Name: http://developer.pidgin.im/wiki/ChangeLog

Type: Patch Information

Hyperlink:http://developer.pidgin.im/wiki/ChangeLog

External Source: REDHAT

Name: RHSA-2010:0115

Hyperlink:https://rhn.redhat.com/errata/RHSA-2010-0115.html

External Source: CONFIRM

Name: https://bugzilla.redhat.com/show_bug.cgi?id=565786

Hyperlink:https://bugzilla.redhat.com/show_bug.cgi?id=565786

External Source: XF

Name: pidgin-xmpp-nickname-dos(56399)

Hyperlink:http://xforce.iss.net/xforce/xfdb/56399

External Source: VUPEN

Name: ADV-2010-1020

Hyperlink:http://www.vupen.com/english/advisories/2010/1020

External Source: VUPEN

Name: ADV-2010-0914

Hyperlink:http://www.vupen.com/english/advisories/2010/0914

External Source: UBUNTU

Name: USN-902-1

Hyperlink:http://www.ubuntu.com/usn/USN-902-1

External Source: BID

Name: 38294

Hyperlink:http://www.securityfocus.com/bid/38294

External Source: OSVDB

Name: 62439

Hyperlink:http://www.osvdb.org/62439

External Source: MANDRIVA

Name: MDVSA-2010:085

Hyperlink:http://www.mandriva.com/security/advisories?name=MDVSA-2010:085

External Source: MANDRIVA

Name: MDVSA-2010:041

Hyperlink:http://www.mandriva.com/security/advisories?name=MDVSA-2010:041

External Source: DEBIAN

Name: DSA-2038

Hyperlink:http://www.debian.org/security/2010/dsa-2038

External Source: SECUNIA

Name: 39509

Hyperlink:http://secunia.com/advisories/39509

External Source: SECUNIA

Name: 38915

Hyperlink:http://secunia.com/advisories/38915

External Source: SECUNIA

Name: 38712

Type: Advisory

Hyperlink:http://secunia.com/advisories/38712

External Source: SECUNIA

Name: 38658

Type: Advisory

Hyperlink:http://secunia.com/advisories/38658

External Source: SECUNIA

Name: 38640

Type: Advisory

Hyperlink:http://secunia.com/advisories/38640

External Source: SECUNIA

Name: 38563

Type: Advisory

Hyperlink:http://secunia.com/advisories/38563

External Source: CONFIRM

Name: http://pidgin.im/news/security/?id=44

Type: Advisory

Hyperlink:http://pidgin.im/news/security/?id=44

External Source: OVAL

Name: oval:org.mitre.oval:def:11485

Hyperlink:http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:11485

External Source: SUSE

Name: SUSE-SR:2010:006

Hyperlink:http://lists.opensuse.org/opensuse-security-announce/2010-03/msg00004.html

External Source: FEDORA

Name: FEDORA-2010-1383

Hyperlink:http://lists.fedoraproject.org/pipermail/package-announce/2010-February/035409.html

External Source: FEDORA

Name: FEDORA-2010-1934

Hyperlink:http://lists.fedoraproject.org/pipermail/package-announce/2010-February/035347.html

External Source: FEDORA

Name: FEDORA-2010-1279

Hyperlink:http://lists.fedoraproject.org/pipermail/package-announce/2010-February/035332.html

References to Check Content

Identifier:oval:org.mitre.oval:def:11485

Check System:http://oval.mitre.org/XMLSchema/oval-definitions-5

Hyperlink:http://oval.mitre.org/repository/data/DownloadDefinition?id=oval:org.mitre.oval:def:11485