CVE-2010-0013
High · 7.5CVSS
7.5
EPSS
12.5%
Published
Jan 9, 2010
CISA due date
—
The record
Directory traversal vulnerability in slp.c in the MSN protocol plugin in libpurple in Pidgin 2.6.4 and Adium 1.3.8 allows remote attackers to read arbitrary files via a .. (dot dot) in an application/x-msnmsgrp2p MSN emoticon (aka custom smiley) request, a related issue to CVE-2004-0122. NOTE: it could be argued that this is resultant from a vulnerability in which an emoticon download request is processed even without a preceding text/x-mms-emoticon message that announced availability of the emoticon.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Debian:10 | pidgin | 0 | 2.6.5-1 |
| Debian:11 | pidgin | 0 | 2.6.5-1 |
| Debian:12 | pidgin | 0 | 2.6.5-1 |
| Debian:13 | pidgin | 0 | 2.6.5-1 |
| Debian:14 | pidgin | 0 | 2.6.5-1 |
| Red Hat:enterprise_linux:4::as | finch | 0 | 0:2.6.5-1.el4.1 |
| Red Hat:enterprise_linux:4::as | finch-devel | 0 | 0:2.6.5-1.el4.1 |
| Red Hat:enterprise_linux:4::as | libpurple | 0 | 0:2.6.5-1.el4.1 |
| Red Hat:enterprise_linux:4::as | libpurple-devel | 0 | 0:2.6.5-1.el4.1 |
| Red Hat:enterprise_linux:4::as | libpurple-perl | 0 | 0:2.6.5-1.el4.1 |
| Red Hat:enterprise_linux:4::as | libpurple-tcl | 0 | 0:2.6.5-1.el4.1 |
| Red Hat:enterprise_linux:4::as | pidgin | 0 | 0:2.6.5-1.el4.1 |
| Red Hat:enterprise_linux:4::as | pidgin-debuginfo | 0 | 0:2.6.5-1.el4.1 |
| Red Hat:enterprise_linux:4::as | pidgin-devel | 0 | 0:2.6.5-1.el4.1 |
| Red Hat:enterprise_linux:4::as | pidgin-perl | 0 | 0:2.6.5-1.el4.1 |
| Red Hat:enterprise_linux:4::desktop | finch | 0 | 0:2.6.5-1.el4.1 |
| Red Hat:enterprise_linux:4::desktop | finch-devel | 0 | 0:2.6.5-1.el4.1 |
| Red Hat:enterprise_linux:4::desktop | libpurple | 0 | 0:2.6.5-1.el4.1 |
| Red Hat:enterprise_linux:4::desktop | libpurple-devel | 0 | 0:2.6.5-1.el4.1 |
| Red Hat:enterprise_linux:4::desktop | libpurple-perl | 0 | 0:2.6.5-1.el4.1 |
| Red Hat:enterprise_linux:4::desktop | libpurple-tcl | 0 | 0:2.6.5-1.el4.1 |
| Red Hat:enterprise_linux:4::desktop | pidgin | 0 | 0:2.6.5-1.el4.1 |
| Red Hat:enterprise_linux:4::desktop | pidgin-debuginfo | 0 | 0:2.6.5-1.el4.1 |
| Red Hat:enterprise_linux:4::desktop | pidgin-devel | 0 | 0:2.6.5-1.el4.1 |
| Red Hat:enterprise_linux:4::desktop | pidgin-perl | 0 | 0:2.6.5-1.el4.1 |
| Red Hat:enterprise_linux:4::es | finch | 0 | 0:2.6.5-1.el4.1 |
| Red Hat:enterprise_linux:4::es | finch-devel | 0 | 0:2.6.5-1.el4.1 |
| Red Hat:enterprise_linux:4::es | libpurple | 0 | 0:2.6.5-1.el4.1 |
| Red Hat:enterprise_linux:4::es | libpurple-devel | 0 | 0:2.6.5-1.el4.1 |
| Red Hat:enterprise_linux:4::es | libpurple-perl | 0 | 0:2.6.5-1.el4.1 |
| Red Hat:enterprise_linux:4::es | libpurple-tcl | 0 | 0:2.6.5-1.el4.1 |
| Red Hat:enterprise_linux:4::es | pidgin | 0 | 0:2.6.5-1.el4.1 |
| Red Hat:enterprise_linux:4::es | pidgin-debuginfo | 0 | 0:2.6.5-1.el4.1 |
| Red Hat:enterprise_linux:4::es | pidgin-devel | 0 | 0:2.6.5-1.el4.1 |
| Red Hat:enterprise_linux:4::es | pidgin-perl | 0 | 0:2.6.5-1.el4.1 |
| Red Hat:enterprise_linux:4::ws | finch | 0 | 0:2.6.5-1.el4.1 |
| Red Hat:enterprise_linux:4::ws | finch-devel | 0 | 0:2.6.5-1.el4.1 |
| Red Hat:enterprise_linux:4::ws | libpurple | 0 | 0:2.6.5-1.el4.1 |
| Red Hat:enterprise_linux:4::ws | libpurple-devel | 0 | 0:2.6.5-1.el4.1 |
| Red Hat:enterprise_linux:4::ws | libpurple-perl | 0 | 0:2.6.5-1.el4.1 |
| Red Hat:enterprise_linux:4::ws | libpurple-tcl | 0 | 0:2.6.5-1.el4.1 |
| Red Hat:enterprise_linux:4::ws | pidgin | 0 | 0:2.6.5-1.el4.1 |
| Red Hat:enterprise_linux:4::ws | pidgin-debuginfo | 0 | 0:2.6.5-1.el4.1 |
| Red Hat:enterprise_linux:4::ws | pidgin-devel | 0 | 0:2.6.5-1.el4.1 |
| Red Hat:enterprise_linux:4::ws | pidgin-perl | 0 | 0:2.6.5-1.el4.1 |
| Red Hat:enterprise_linux:5::client | finch | 0 | 0:2.6.5-1.el5 |
| Red Hat:enterprise_linux:5::client | finch-devel | 0 | 0:2.6.5-1.el5 |
| Red Hat:enterprise_linux:5::client | libpurple | 0 | 0:2.6.5-1.el5 |
| Red Hat:enterprise_linux:5::client | libpurple-devel | 0 | 0:2.6.5-1.el5 |
| Red Hat:enterprise_linux:5::client | libpurple-perl | 0 | 0:2.6.5-1.el5 |
| Red Hat:enterprise_linux:5::client | libpurple-tcl | 0 | 0:2.6.5-1.el5 |
| Red Hat:enterprise_linux:5::client | pidgin | 0 | 0:2.6.5-1.el5 |
| Red Hat:enterprise_linux:5::client | pidgin-debuginfo | 0 | 0:2.6.5-1.el5 |
| Red Hat:enterprise_linux:5::client | pidgin-devel | 0 | 0:2.6.5-1.el5 |
| Red Hat:enterprise_linux:5::client | pidgin-perl | 0 | 0:2.6.5-1.el5 |
| Red Hat:enterprise_linux:5::client_workstation | finch | 0 | 0:2.6.5-1.el5 |
| Red Hat:enterprise_linux:5::client_workstation | finch-devel | 0 | 0:2.6.5-1.el5 |
| Red Hat:enterprise_linux:5::client_workstation | libpurple | 0 | 0:2.6.5-1.el5 |
| Red Hat:enterprise_linux:5::client_workstation | libpurple-devel | 0 | 0:2.6.5-1.el5 |
| Red Hat:enterprise_linux:5::client_workstation | libpurple-perl | 0 | 0:2.6.5-1.el5 |
| Red Hat:enterprise_linux:5::client_workstation | libpurple-tcl | 0 | 0:2.6.5-1.el5 |
| Red Hat:enterprise_linux:5::client_workstation | pidgin | 0 | 0:2.6.5-1.el5 |
| Red Hat:enterprise_linux:5::client_workstation | pidgin-debuginfo | 0 | 0:2.6.5-1.el5 |
| Red Hat:enterprise_linux:5::client_workstation | pidgin-devel | 0 | 0:2.6.5-1.el5 |
| Red Hat:enterprise_linux:5::client_workstation | pidgin-perl | 0 | 0:2.6.5-1.el5 |
| Red Hat:rhel_productivity:5 | finch | 0 | 0:2.6.5-1.el5 |
| Red Hat:rhel_productivity:5 | finch-devel | 0 | 0:2.6.5-1.el5 |
| Red Hat:rhel_productivity:5 | libpurple | 0 | 0:2.6.5-1.el5 |
| Red Hat:rhel_productivity:5 | libpurple-devel | 0 | 0:2.6.5-1.el5 |
| Red Hat:rhel_productivity:5 | libpurple-perl | 0 | 0:2.6.5-1.el5 |
| Red Hat:rhel_productivity:5 | libpurple-tcl | 0 | 0:2.6.5-1.el5 |
| Red Hat:rhel_productivity:5 | pidgin | 0 | 0:2.6.5-1.el5 |
| Red Hat:rhel_productivity:5 | pidgin-debuginfo | 0 | 0:2.6.5-1.el5 |
| Red Hat:rhel_productivity:5 | pidgin-devel | 0 | 0:2.6.5-1.el5 |
| Red Hat:rhel_productivity:5 | pidgin-perl | 0 | 0:2.6.5-1.el5 |
Related vulnerabilities
- CVE-2009-2694 The msn_slplink_process_msg function in libpurple/protocols/msn/slplink.c in libpurple… Also affects pidgin
- CVE-2022-26491 An issue was discovered in Pidgin before 2.14.9. Also affects pidgin
- CVE-2016-2365 A denial of service vulnerability exists in the handling of the MXIT protocol in Pidgin. Also affects pidgin
- CVE-2014-3694 The (1) bundled GnuTLS SSL/TLS plugin and the (2) bundled OpenSSL SSL/TLS plugin in… Also affects pidgin
- CVE-2013-6490 The SIMPLE protocol functionality in Pidgin before 2.10.8 allows remote attackers to have… Also affects pidgin
- CVE-2009-1376 Multiple integer overflows in the msn_slplink_process_msg functions in the MSN protocol… Also affects pidgin
- CVE-2026-81163 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')… CWE-22
- CVE-2026-112049 Vita3K before build 4187 contains a path traversal (zip slip) vulnerability in… CWE-22