Executive Summary

Informations
Name CVE-2012-6152 First vendor Publication 2014-02-06
Vendor Cve Last vendor Modification 2014-03-16

Security-Database Scoring CVSS v3

Cvss vector : N/A
Overall CVSS Score NA
Base Score NA Environmental Score NA
impact SubScore NA Temporal Score NA
Exploitabality Sub Score NA
 
Calculate full CVSS 3.0 Vectors scores

Security-Database Scoring CVSS v2

Cvss vector : (AV:N/AC:L/Au:N/C:N/I:N/A:P)
Cvss Base Score 5 Attack Range Network
Cvss Impact Score 2.9 Attack Complexity Low
Cvss Expoit Score 10 Authentication None Required
Calculate full CVSS 2.0 Vectors scores

Detail

The Yahoo! protocol plugin in libpurple in Pidgin before 2.10.8 does not properly validate UTF-8 data, which allows remote attackers to cause a denial of service (application crash) via crafted byte sequences.

Original Source

Url : http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-6152

CWE : Common Weakness Enumeration

% Id Name
100 % CWE-20 Improper Input Validation

OVAL Definitions

Definition Id: oval:org.mitre.oval:def:25166
 
Oval ID: oval:org.mitre.oval:def:25166
Title: SUSE-SU-2014:0702-1 -- Security update for finch
Description: The pidgin Instant Messenger has been updated to fix various security issues: * CVE-2014-0020: Remotely triggerable crash in IRC argument parsing * CVE-2013-6490: Buffer overflow in SIMPLE header parsing * CVE-2013-6489: Buffer overflow in MXit emoticon parsing * CVE-2013-6487: Buffer overflow in Gadu-Gadu HTTP parsing * CVE-2013-6486: Pidgin uses clickable links to untrusted executables * CVE-2013-6485: Buffer overflow parsing chunked HTTP responses * CVE-2013-6484: Crash reading response from STUN server * CVE-2013-6483: XMPP doesn't verify 'from' on some iq replies * CVE-2013-6482: NULL pointer dereference parsing SOAP data in MSN * CVE-2013-6482: NULL pointer dereference parsing OIM data in MSN * CVE-2013-6482: NULL pointer dereference parsing headers in MSN * CVE-2013-6481: Remote crash reading Yahoo! P2P message * CVE-2013-6479: Remote crash parsing HTTP responses * CVE-2013-6478: Crash when hovering pointer over a long URL * CVE-2013-6477: Crash handling bad XMPP timestamp * CVE-2012-6152: Yahoo! remote crash from incorrect character encoding
Family: unix Class: patch
Reference(s): SUSE-SU-2014:0702-1
CVE-2014-0020
CVE-2013-6490
CVE-2013-6489
CVE-2013-6487
CVE-2013-6486
CVE-2013-6485
CVE-2013-6484
CVE-2013-6483
CVE-2013-6482
CVE-2013-6481
CVE-2013-6479
CVE-2013-6478
CVE-2013-6477
CVE-2012-6152
 Version: 3
Platform(s): SUSE Linux Enterprise Desktop 11
 Product(s): finch
Definition Synopsis:

CPE : Common Platform Enumeration

TypeDescriptionCount
Application 66

Nessus® Vulnerability Scanner

Date Description
2015-01-19 Name : The remote Solaris system is missing a security patch for third-party software.
File : solaris11_pidgin_20140731.nasl - Type : ACT_GATHER_INFO
2014-06-13 Name : The remote openSUSE host is missing a security update.
File : openSUSE-2014-132.nasl - Type : ACT_GATHER_INFO
2014-05-24 Name : The remote SuSE 11 host is missing one or more security updates.
File : suse_11_finch-140508.nasl - Type : ACT_GATHER_INFO
2014-05-19 Name : The remote Gentoo host is missing one or more security-related patches.
File : gentoo_GLSA-201405-22.nasl - Type : ACT_GATHER_INFO
2014-02-17 Name : The remote Fedora host is missing a security update.
File : fedora_2014-1999.nasl - Type : ACT_GATHER_INFO
2014-02-07 Name : The remote Ubuntu host is missing one or more security-related patches.
File : ubuntu_USN-2100-1.nasl - Type : ACT_GATHER_INFO
2014-02-06 Name : The remote CentOS host is missing one or more security updates.
File : centos_RHSA-2014-0139.nasl - Type : ACT_GATHER_INFO
2014-02-06 Name : The remote Fedora host is missing a security update.
File : fedora_2014-2013.nasl - Type : ACT_GATHER_INFO
2014-02-06 Name : The remote Oracle Linux host is missing one or more security updates.
File : oraclelinux_ELSA-2014-0139.nasl - Type : ACT_GATHER_INFO
2014-02-06 Name : The remote Red Hat host is missing one or more security updates.
File : redhat-RHSA-2014-0139.nasl - Type : ACT_GATHER_INFO
2014-02-06 Name : The remote Scientific Linux host is missing one or more security updates.
File : sl_20140205_pidgin_on_SL5_x.nasl - Type : ACT_GATHER_INFO
2014-02-04 Name : The remote Slackware host is missing a security update.
File : Slackware_SSA_2014-034-01.nasl - Type : ACT_GATHER_INFO
2014-02-04 Name : An instant messaging client installed on the remote Windows host is affected ...
File : pidgin_2_10_8.nasl - Type : ACT_GATHER_INFO

Sources (Detail)

Source Url
CONFIRM http://hg.pidgin.im/pidgin/main/rev/b0345c25f886
http://pidgin.im/news/security/?id=70
REDHAT https://rhn.redhat.com/errata/RHSA-2014-0139.html
SUSE http://lists.opensuse.org/opensuse-updates/2014-02/msg00039.html
http://lists.opensuse.org/opensuse-updates/2014-03/msg00005.html
UBUNTU http://www.ubuntu.com/usn/USN-2100-1

Alert History

If you want to see full details history, please login or register.
0
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
Date Informations
2021-05-05 01:11:42
  • Multiple Updates
2021-05-04 12:22:44
  • Multiple Updates
2021-04-22 01:27:07
  • Multiple Updates
2020-05-23 01:50:26
  • Multiple Updates
2020-05-23 00:35:27
  • Multiple Updates
2019-06-05 12:04:26
  • Multiple Updates
2018-09-25 12:09:06
  • Multiple Updates
2016-04-26 22:34:45
  • Multiple Updates
2015-01-21 13:25:59
  • Multiple Updates
2014-06-14 13:34:09
  • Multiple Updates
2014-05-25 13:23:05
  • Multiple Updates
2014-05-20 13:23:14
  • Multiple Updates
2014-03-18 13:22:19
  • Multiple Updates
2014-03-08 13:22:04
  • Multiple Updates
2014-03-06 13:22:03
  • Multiple Updates
2014-02-25 13:22:17
  • Multiple Updates
2014-02-17 13:21:20
  • Multiple Updates
2014-02-17 11:14:54
  • Multiple Updates
2014-02-14 17:19:50
  • Multiple Updates
2014-02-07 00:18:57
  • Multiple Updates
2014-02-06 21:20:46
  • First insertion