5 - CVE-2014-0020

Executive Summary

Informations
Name	CVE-2014-0020	First vendor Publication	2014-02-06
Vendor	Cve	Last vendor Modification	2024-11-21

Security-Database Scoring CVSS v3

Cvss vector : N/A
Overall CVSS Score	NA
Base Score	NA	Environmental Score	NA
impact SubScore	NA	Temporal Score	NA
Exploitabality Sub Score	NA

Calculate full CVSS 3.0 Vectors scores

Security-Database Scoring CVSS v2

Cvss vector : (AV:N/AC:L/Au:N/C:N/I:N/A:P)
Cvss Base Score	5	Attack Range	Network
Cvss Impact Score	2.9	Attack Complexity	Low
Cvss Expoit Score	10	Authentication	None Required
Calculate full CVSS 2.0 Vectors scores

Detail

The IRC protocol plugin in libpurple in Pidgin before 2.10.8 does not validate argument counts, which allows remote IRC servers to cause a denial of service (application crash) via a crafted message.

Original Source

Url : http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0020

CWE : Common Weakness Enumeration

%	Id	Name
100 %	CWE-20	Improper Input Validation

OVAL Definitions

Definition Id: oval:org.mitre.oval:def:22203

Oval ID:	oval:org.mitre.oval:def:22203
Title:	RHSA-2014:0139: pidgin security update (Moderate)
Description:	The IRC protocol plugin in libpurple in Pidgin before 2.10.8 does not validate argument counts, which allows remote IRC servers to cause a denial of service (application crash) via a crafted message.
Family:	unix	Class:	patch
Reference(s):	RHSA-2014:0139-00 CESA-2014:0139 CVE-2012-6152 CVE-2013-6477 CVE-2013-6478 CVE-2013-6479 CVE-2013-6481 CVE-2013-6482 CVE-2013-6483 CVE-2013-6484 CVE-2013-6485 CVE-2013-6487 CVE-2013-6489 CVE-2013-6490 CVE-2014-0020	Version:	111
Platform(s):	Red Hat Enterprise Linux 5 Red Hat Enterprise Linux 6 CentOS Linux 5 CentOS Linux 6	Product(s):	pidgin
Definition Synopsis:
Operation system section Redhat 5 or Centos 5 release The operating system installed on the system is Red Hat Enterprise Linux 5 AND The operating system installed on the system is CentOS Linux 5.x Packages section libpurple is earlier than 0:2.6.6-32.el5 AND pidgin-perl is earlier than 0:2.6.6-32.el5 AND libpurple-tcl is earlier than 0:2.6.6-32.el5 AND pidgin-devel is earlier than 0:2.6.6-32.el5 AND libpurple-perl is earlier than 0:2.6.6-32.el5 AND finch is earlier than 0:2.6.6-32.el5 AND libpurple-devel is earlier than 0:2.6.6-32.el5 AND pidgin is earlier than 0:2.6.6-32.el5 AND finch-devel is earlier than 0:2.6.6-32.el5 AND Operation system section Redhat 6 or Centos 6 release The operating system installed on the system is Red Hat Enterprise Linux 6 AND The operating system installed on the system is CentOS Linux 6.x Packages section libpurple is earlier than 0:2.7.9-27.el6 AND pidgin-perl is earlier than 0:2.7.9-27.el6 AND pidgin-docs is earlier than 0:2.7.9-27.el6 AND libpurple-tcl is earlier than 0:2.7.9-27.el6 AND pidgin-devel is earlier than 0:2.7.9-27.el6 AND libpurple-perl is earlier than 0:2.7.9-27.el6 AND finch is earlier than 0:2.7.9-27.el6 AND libpurple-devel is earlier than 0:2.7.9-27.el6 AND pidgin is earlier than 0:2.7.9-27.el6 AND finch-devel is earlier than 0:2.7.9-27.el6

Definition Id: oval:org.mitre.oval:def:22474

Oval ID:	oval:org.mitre.oval:def:22474
Title:	DSA-2859-1 pidgin - several
Description:	Multiple vulnerabilities have been discovered in Pidgin, a multi-protocol instant messaging client.
Family:	unix	Class:	patch
Reference(s):	DSA-2859-1 CVE-2013-6477 CVE-2013-6478 CVE-2013-6479 CVE-2013-6481 CVE-2013-6482 CVE-2013-6483 CVE-2013-6484 CVE-2013-6485 CVE-2013-6487 CVE-2013-6489 CVE-2013-6490 CVE-2014-0020	Version:	5
Platform(s):	Debian GNU/Linux 7 Debian GNU/kFreeBSD 7	Product(s):	pidgin
Definition Synopsis:
Debian 7 is installed GNU/Linux or GNU/kFreeBSD kernel Debian GNU/Linux is installed AND Debian GNU/kFreeBSD is installed AND pidgin DPKG is earlier than 0:2.10.9-1~deb7u1

Definition Id: oval:org.mitre.oval:def:22557

Oval ID:	oval:org.mitre.oval:def:22557
Title:	USN-2100-1 -- pidgin vulnerabilities
Description:	Several security issues were fixed in Pidgin.
Family:	unix	Class:	patch
Reference(s):	USN-2100-1 CVE-2012-6152 CVE-2013-6477 CVE-2013-6478 CVE-2013-6479 CVE-2013-6481 CVE-2013-6482 CVE-2013-6483 CVE-2013-6484 CVE-2013-6485 CVE-2013-6487 CVE-2013-6489 CVE-2013-6490 CVE-2014-0020	Version:	5
Platform(s):	Ubuntu 13.10 Ubuntu 12.10 Ubuntu 12.04	Product(s):	pidgin
Definition Synopsis:
Ubuntu 13.10 release section Ubuntu 13.10 is installed Packages match section libpurple0 DPKG is earlier than 1:2.10.7-0ubuntu4.1.13.10.1 AND pidgin DPKG is earlier than 1:2.10.7-0ubuntu4.1.13.10.1 AND Ubuntu 12.10 release section Ubuntu 12.10 is installed Packages match section libpurple0 DPKG is earlier than 1:2.10.6-0ubuntu2.3 AND pidgin DPKG is earlier than 1:2.10.6-0ubuntu2.3 AND Ubuntu 12.04 release section Ubuntu 12.04 is installed Packages match section libpurple0 DPKG is earlier than 1:2.10.3-0ubuntu1.4 AND pidgin DPKG is earlier than 1:2.10.3-0ubuntu1.4

Definition Id: oval:org.mitre.oval:def:22786

Oval ID:	oval:org.mitre.oval:def:22786
Title:	DEPRECATED: ELSA-2014:0139: pidgin security update (Moderate)
Description:	The IRC protocol plugin in libpurple in Pidgin before 2.10.8 does not validate argument counts, which allows remote IRC servers to cause a denial of service (application crash) via a crafted message.
Family:	unix	Class:	patch
Reference(s):	ELSA-2014:0139-00 CVE-2012-6152 CVE-2013-6477 CVE-2013-6478 CVE-2013-6479 CVE-2013-6481 CVE-2013-6482 CVE-2013-6483 CVE-2013-6484 CVE-2013-6485 CVE-2013-6487 CVE-2013-6489 CVE-2013-6490 CVE-2014-0020	Version:	58
Platform(s):	Oracle Linux 5 Oracle Linux 6	Product(s):	pidgin
Definition Synopsis:
rpm test Oracle Linux 5.x AND rpm test libpurple is earlier than 0:2.6.6-32.el5 AND pidgin-perl is earlier than 0:2.6.6-32.el5 AND libpurple-tcl is earlier than 0:2.6.6-32.el5 AND pidgin-devel is earlier than 0:2.6.6-32.el5 AND libpurple-perl is earlier than 0:2.6.6-32.el5 AND finch is earlier than 0:2.6.6-32.el5 AND libpurple-devel is earlier than 0:2.6.6-32.el5 AND pidgin is earlier than 0:2.6.6-32.el5 AND finch-devel is earlier than 0:2.6.6-32.el5 OR rpm test Oracle Linux 6.x AND rpm test libpurple is earlier than 0:2.7.9-27.el6 AND pidgin-perl is earlier than 0:2.7.9-27.el6 AND pidgin-docs is earlier than 0:2.7.9-27.el6 AND libpurple-tcl is earlier than 0:2.7.9-27.el6 AND pidgin-devel is earlier than 0:2.7.9-27.el6 AND libpurple-perl is earlier than 0:2.7.9-27.el6 AND finch is earlier than 0:2.7.9-27.el6 AND libpurple-devel is earlier than 0:2.7.9-27.el6 AND pidgin is earlier than 0:2.7.9-27.el6 AND finch-devel is earlier than 0:2.7.9-27.el6

Definition Id: oval:org.mitre.oval:def:24167

Oval ID:	oval:org.mitre.oval:def:24167
Title:	ELSA-2014:0139: pidgin security update (Moderate)
Description:	The IRC protocol plugin in libpurple in Pidgin before 2.10.8 does not validate argument counts, which allows remote IRC servers to cause a denial of service (application crash) via a crafted message.
Family:	unix	Class:	patch
Reference(s):	ELSA-2014:0139-00 CVE-2012-6152 CVE-2013-6477 CVE-2013-6478 CVE-2013-6479 CVE-2013-6481 CVE-2013-6482 CVE-2013-6483 CVE-2013-6484 CVE-2013-6485 CVE-2013-6487 CVE-2013-6489 CVE-2013-6490 CVE-2014-0020	Version:	57
Platform(s):	Oracle Linux 5 Oracle Linux 6	Product(s):	pidgin
Definition Synopsis:
rpm test Oracle Linux 5.x AND rpm test libpurple is earlier than 0:2.6.6-32.el5 AND pidgin-perl is earlier than 0:2.6.6-32.el5 AND libpurple-tcl is earlier than 0:2.6.6-32.el5 AND pidgin-devel is earlier than 0:2.6.6-32.el5 AND libpurple-perl is earlier than 0:2.6.6-32.el5 AND finch is earlier than 0:2.6.6-32.el5 AND libpurple-devel is earlier than 0:2.6.6-32.el5 AND pidgin is earlier than 0:2.6.6-32.el5 AND finch-devel is earlier than 0:2.6.6-32.el5 OR rpm test Oracle Linux 6.x AND rpm test libpurple is earlier than 0:2.7.9-27.el6 AND pidgin-perl is earlier than 0:2.7.9-27.el6 AND pidgin-docs is earlier than 0:2.7.9-27.el6 AND libpurple-tcl is earlier than 0:2.7.9-27.el6 AND pidgin-devel is earlier than 0:2.7.9-27.el6 AND libpurple-perl is earlier than 0:2.7.9-27.el6 AND finch is earlier than 0:2.7.9-27.el6 AND libpurple-devel is earlier than 0:2.7.9-27.el6 AND pidgin is earlier than 0:2.7.9-27.el6 AND finch-devel is earlier than 0:2.7.9-27.el6

Definition Id: oval:org.mitre.oval:def:24323

Oval ID:	oval:org.mitre.oval:def:24323
Title:	DSA-2859-2 pidgin - security update
Description:	Multiple vulnerabilities have been discovered in Pidgin, a multi-protocol instant messaging client.
Family:	unix	Class:	patch
Reference(s):	DSA-2859-2 CVE-2013-6477 CVE-2013-6478 CVE-2013-6479 CVE-2013-6481 CVE-2013-6482 CVE-2013-6483 CVE-2013-6484 CVE-2013-6485 CVE-2013-6487 CVE-2013-6489 CVE-2013-6490 CVE-2014-0020	Version:	5
Platform(s):	Debian GNU/Linux 6.0 Debian GNU/kFreeBSD 6.0	Product(s):	pidgin
Definition Synopsis:
Debian 6.0 is installed GNU/Linux or GNU/kFreeBSD kernel Debian GNU/Linux is installed AND Debian GNU/kFreeBSD is installed AND pidgin DPKG is earlier than 0:2.7.3-1+squeeze4

Definition Id: oval:org.mitre.oval:def:27284

Oval ID:	oval:org.mitre.oval:def:27284
Title:	DEPRECATED: ELSA-2014-0139 -- pidgin security update (moderate)
Description:	[2.7.9-27.el6] - Fix regression in CVE-2013-6483.
Family:	unix	Class:	patch
Reference(s):	ELSA-2014-0139 CVE-2012-6152 CVE-2013-6477 CVE-2013-6478 CVE-2013-6479 CVE-2013-6481 CVE-2013-6482 CVE-2013-6483 CVE-2013-6484 CVE-2013-6485 CVE-2013-6487 CVE-2013-6489 CVE-2013-6490 CVE-2014-0020	Version:	4
Platform(s):	Oracle Linux 6	Product(s):	pidgin
Definition Synopsis:
Oracle Linux 6.x Packages match section pidgin is earlier than 0:2.7.9-27.el6 AND finch is earlier than 0:2.7.9-27.el6 AND finch-devel is earlier than 0:2.7.9-27.el6 AND libpurple is earlier than 0:2.7.9-27.el6 AND libpurple-devel is earlier than 0:2.7.9-27.el6 AND libpurple-perl is earlier than 0:2.7.9-27.el6 AND libpurple-tcl is earlier than 0:2.7.9-27.el6 AND pidgin-devel is earlier than 0:2.7.9-27.el6 AND pidgin-docs is earlier than 0:2.7.9-27.el6 AND pidgin-perl is earlier than 0:2.7.9-27.el6

CPE : Common Platform Enumeration

Type	Description	Count
Application	Pidgin cpe:2.3:a:pidgin:pidgin:2.9.0:::::::* cpe:2.3:a:pidgin:pidgin:2.8.0:::::::* cpe:2.3:a:pidgin:pidgin:2.7.9:::::::* cpe:2.3:a:pidgin:pidgin:2.7.8:::::::* cpe:2.3:a:pidgin:pidgin:2.7.7:::::::* cpe:2.3:a:pidgin:pidgin:2.7.6:::::::* cpe:2.3:a:pidgin:pidgin:2.7.5:::::::* cpe:2.3:a:pidgin:pidgin:2.7.4:::::::* cpe:2.3:a:pidgin:pidgin:2.7.3:::::::* cpe:2.3:a:pidgin:pidgin:2.7.2:::::::* cpe:2.3:a:pidgin:pidgin:2.7.11:::::::* cpe:2.3:a:pidgin:pidgin:2.7.10:::::::* cpe:2.3:a:pidgin:pidgin:2.7.1:::::::* cpe:2.3:a:pidgin:pidgin:2.7.0:::::::* cpe:2.3:a:pidgin:pidgin:2.6.6:::::::* cpe:2.3:a:pidgin:pidgin:2.6.5:::::::* cpe:2.3:a:pidgin:pidgin:2.6.4:::::::* cpe:2.3:a:pidgin:pidgin:2.6.3:::::::* cpe:2.3:a:pidgin:pidgin:2.6.2:::::::* cpe:2.3:a:pidgin:pidgin:2.6.1:::::::* cpe:2.3:a:pidgin:pidgin:2.6.0:::::::* cpe:2.3:a:pidgin:pidgin:2.5.9:::::::* cpe:2.3:a:pidgin:pidgin:2.5.8:::::::* cpe:2.3:a:pidgin:pidgin:2.5.7:::::::* cpe:2.3:a:pidgin:pidgin:2.5.6:::::::* cpe:2.3:a:pidgin:pidgin:2.5.5:32_bit:::::: cpe:2.3:a:pidgin:pidgin:2.5.5:::::::* cpe:2.3:a:pidgin:pidgin:2.5.4:32_bit:::::: cpe:2.3:a:pidgin:pidgin:2.5.4:::::::* cpe:2.3:a:pidgin:pidgin:2.5.3:::::::* cpe:2.3:a:pidgin:pidgin:2.5.3:32_bit:::::: cpe:2.3:a:pidgin:pidgin:2.5.2:32_bit:::::: cpe:2.3:a:pidgin:pidgin:2.5.2:::::::* cpe:2.3:a:pidgin:pidgin:2.5.1:::::::* cpe:2.3:a:pidgin:pidgin:2.5.0:32_bit:::::: cpe:2.3:a:pidgin:pidgin:2.5.0:::::::* cpe:2.3:a:pidgin:pidgin:2.4.3:::::::* cpe:2.3:a:pidgin:pidgin:2.4.3:32_bit:::::: cpe:2.3:a:pidgin:pidgin:2.4.2:::::::* cpe:2.3:a:pidgin:pidgin:2.4.2:32_bit:::::: cpe:2.3:a:pidgin:pidgin:2.4.1:32_bit:::::: cpe:2.3:a:pidgin:pidgin:2.4.1:::::::* cpe:2.3:a:pidgin:pidgin:2.4.0:32_bit:::::: cpe:2.3:a:pidgin:pidgin:2.4.0:::::::* cpe:2.3:a:pidgin:pidgin:2.3.1:::::::* cpe:2.3:a:pidgin:pidgin:2.3.0:::::::* cpe:2.3:a:pidgin:pidgin:2.2.2:::::::* cpe:2.3:a:pidgin:pidgin:2.2.1:::::::* cpe:2.3:a:pidgin:pidgin:2.2.0:::::::* cpe:2.3:a:pidgin:pidgin:2.10.7:::::::* cpe:2.3:a:pidgin:pidgin:2.10.6:::::::* cpe:2.3:a:pidgin:pidgin:2.10.5:::::::* cpe:2.3:a:pidgin:pidgin:2.10.4:::::::* cpe:2.3:a:pidgin:pidgin:2.10.3:::::::* cpe:2.3:a:pidgin:pidgin:2.10.2:::::::* cpe:2.3:a:pidgin:pidgin:2.10.1:::::::* cpe:2.3:a:pidgin:pidgin:2.10.0:::::::* cpe:2.3:a:pidgin:pidgin:2.1.1:::::::* cpe:2.3:a:pidgin:pidgin:2.1.0:::::::* cpe:2.3:a:pidgin:pidgin:2.0.2::linux::::: cpe:2.3:a:pidgin:pidgin:2.0.2:::::::* cpe:2.3:a:pidgin:pidgin:2.0.1:::::::* cpe:2.3:a:pidgin:pidgin:2.0.0:::::::* cpe:2.3:a:pidgin:pidgin:1.5.1:::::::* cpe:2.3:a:pidgin:pidgin:::::::: cpe:2.3:a:pidgin:pidgin:-:::::::*	66

Nessus® Vulnerability Scanner

Date	Description
2015-01-19	Name : The remote Solaris system is missing a security patch for third-party software. File : solaris11_pidgin_20140731.nasl - Type : ACT_GATHER_INFO
2014-06-13	Name : The remote openSUSE host is missing a security update. File : openSUSE-2014-132.nasl - Type : ACT_GATHER_INFO
2014-05-24	Name : The remote SuSE 11 host is missing one or more security updates. File : suse_11_finch-140508.nasl - Type : ACT_GATHER_INFO
2014-05-19	Name : The remote Gentoo host is missing one or more security-related patches. File : gentoo_GLSA-201405-22.nasl - Type : ACT_GATHER_INFO
2014-02-17	Name : The remote Fedora host is missing a security update. File : fedora_2014-1999.nasl - Type : ACT_GATHER_INFO
2014-02-12	Name : The remote Debian host is missing a security-related update. File : debian_DSA-2859.nasl - Type : ACT_GATHER_INFO
2014-02-07	Name : The remote Ubuntu host is missing one or more security-related patches. File : ubuntu_USN-2100-1.nasl - Type : ACT_GATHER_INFO
2014-02-06	Name : The remote CentOS host is missing one or more security updates. File : centos_RHSA-2014-0139.nasl - Type : ACT_GATHER_INFO
2014-02-06	Name : The remote Fedora host is missing a security update. File : fedora_2014-2013.nasl - Type : ACT_GATHER_INFO
2014-02-06	Name : The remote Oracle Linux host is missing one or more security updates. File : oraclelinux_ELSA-2014-0139.nasl - Type : ACT_GATHER_INFO
2014-02-06	Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2014-0139.nasl - Type : ACT_GATHER_INFO
2014-02-06	Name : The remote Scientific Linux host is missing one or more security updates. File : sl_20140205_pidgin_on_SL5_x.nasl - Type : ACT_GATHER_INFO
2014-02-04	Name : The remote Slackware host is missing a security update. File : Slackware_SSA_2014-034-01.nasl - Type : ACT_GATHER_INFO
2014-02-04	Name : An instant messaging client installed on the remote Windows host is affected ... File : pidgin_2_10_8.nasl - Type : ACT_GATHER_INFO

Sources (Detail)

http://hg.pidgin.im/pidgin/main/rev/4d9be297d399
http://hg.pidgin.im/pidgin/main/rev/5845d9fa7084
http://hg.pidgin.im/pidgin/main/rev/6b0e0566af20
http://hg.pidgin.im/pidgin/main/rev/7d0fb0c6d8d4
http://hg.pidgin.im/pidgin/main/rev/9f132a6855cd
http://hg.pidgin.im/pidgin/main/rev/a167504359e5
http://lists.opensuse.org/opensuse-updates/2014-02/msg00039.html
http://lists.opensuse.org/opensuse-updates/2014-03/msg00005.html
http://pidgin.im/news/security/?id=85
http://www.debian.org/security/2014/dsa-2859
http://www.ubuntu.com/usn/USN-2100-1
https://rhn.redhat.com/errata/RHSA-2014-0139.html

Source	Url

Alert History

If you want to see full details history, please login or register.

Date	Informations
2024-11-28 12:38:18	Multiple Updates
2021-05-05 01:14:12	Multiple Updates
2021-05-04 12:29:19	Multiple Updates
2021-04-22 01:35:35	Multiple Updates
2020-05-23 01:50:38	Multiple Updates
2020-05-23 00:39:15	Multiple Updates
2019-06-05 12:05:11	Multiple Updates
2018-09-25 12:09:48	Multiple Updates
2016-04-27 00:01:24	Multiple Updates
2015-01-21 13:26:37	Multiple Updates
2014-06-14 13:36:47	Multiple Updates
2014-05-25 13:23:08	Multiple Updates
2014-05-20 13:23:19	Multiple Updates
2014-03-18 13:23:32	Multiple Updates
2014-03-08 13:23:18	Multiple Updates
2014-03-06 13:24:23	Multiple Updates
2014-02-17 13:21:23	Multiple Updates
2014-02-17 11:24:44	Multiple Updates
2014-02-14 17:21:07	Multiple Updates
2014-02-10 21:23:26	Multiple Updates
2014-02-07 13:21:20	Multiple Updates
2014-02-06 21:21:06	First insertion

Global Informations

Type	Count
CWE ID(s)	1
Oval ID(s)	7
CPE ID(s)	66
Sources(s)	12
Nessus® Exploit(s)	14

	Related
10	USN-2100-1
10	RHSA-2014:0139
10	MDVSA-2014:025
10	GLSA-201405-22
10	DSA-2859
Info : listing not affected by your CVSS Env Score

Same Subject	Severity
Login to view 5 more Alert(s)

5 - CVE-2014-0020

Executive Summary

Security-Database Scoring CVSS v3

Security-Database Scoring CVSS v2

Detail

Original Source

CWE : Common Weakness Enumeration

OVAL Definitions

CPE : Common Platform Enumeration

Nessus® Vulnerability Scanner

Sources (Detail)

Alert History

Global Informations

Open Standards

Other Databases

COMPANY

STANDARDS

RECENT POSTS

MENU