Not a U.S. government website. NDD is an independent vulnerability database by Volerion and is not affiliated with or endorsed by NIST or NVD.

CVE-2010-0013 Details

Description

Directory traversal vulnerability in slp.c in the MSN protocol plugin in libpurple in Pidgin 2.6.4 and Adium 1.3.8 allows remote attackers to read arbitrary files via a .. (dot dot) in an application/x-msnmsgrp2p MSN emoticon (aka custom smiley) request, a related issue to CVE-2004-0122. NOTE: it could be argued that this is resultant from a vulnerability in which an emoticon download request is processed even without a preceding text/x-mms-emoticon message that announced availability of the emoticon.

Metrics

CVSS 3.x Severity and Vector Strings:

NIST: [email protected]CVSS-B:7.5 HIGHVector:CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.

URL	Source(s)	Tag(s)
http://developer.pidgin.im/viewmtn/revision/diff/3d02401cf232459fc80c0837d31e05fae7ae5467/with/c64a1adc8bda2b4aeaae1f273541afbc4f71b810/libpurple/protocols/msn/slp.c	CVE	Broken Link
http://d.pidgin.im/viewmtn/revision/info/3d02401cf232459fc80c0837d31e05fae7ae5467	CVE	Broken Link
http://d.pidgin.im/viewmtn/revision/info/4be2df4f72bd8a55cdae7f2554b73342a497c92f	CVE	Broken Link
http://d.pidgin.im/viewmtn/revision/info/c64a1adc8bda2b4aeaae1f273541afbc4f71b810	CVE	Broken Link
http://events.ccc.de/congress/2009/Fahrplan/events/3596.en.html	CVE	Product
http://lists.fedoraproject.org/pipermail/package-announce/2010-January/033771.html	CVE	Mailing List
http://lists.fedoraproject.org/pipermail/package-announce/2010-January/033848.html	CVE	Mailing List
http://lists.opensuse.org/opensuse-security-announce/2010-03/msg00004.html	CVE	Mailing List
https://bugzilla.redhat.com/show_bug.cgi?id=552483	CVE	Issue TrackingPatch
http://secunia.com/advisories/37953	CVE	Broken LinkVendor Advisory
http://secunia.com/advisories/37954	CVE	Broken LinkVendor Advisory
http://secunia.com/advisories/37961	CVE	Broken Link
http://secunia.com/advisories/38915	CVE	Broken Link
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10333	CVE	Broken Link
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A17620	CVE	Broken Link
http://sunsolve.sun.com/search/document.do?assetkey=1-66-277450-1	CVE	Broken Link
http://sunsolve.sun.com/search/document.do?assetkey=1-77-1022203.1-1	CVE	Broken Link
http://www.mandriva.com/security/advisories?name=MDVSA-2010:085	CVE	Broken Link
http://www.openwall.com/lists/oss-security/2010/01/02/1	CVE	Mailing ListPatch
http://www.openwall.com/lists/oss-security/2010/01/07/1	CVE	Mailing List
http://www.openwall.com/lists/oss-security/2010/01/07/2	CVE	Mailing List
http://www.vupen.com/english/advisories/2009/3662	CVE	Permissions RequiredVendor Advisory
http://www.vupen.com/english/advisories/2009/3663	CVE	Permissions RequiredVendor Advisory
http://www.vupen.com/english/advisories/2010/1020	CVE	Permissions Required
http://developer.pidgin.im/viewmtn/revision/diff/3d02401cf232459fc80c0837d31e05fae7ae5467/with/c64a1adc8bda2b4aeaae1f273541afbc4f71b810/libpurple/protocols/msn/slp.c	[email protected]	Broken Link
http://d.pidgin.im/viewmtn/revision/info/3d02401cf232459fc80c0837d31e05fae7ae5467	[email protected]	Broken Link
http://d.pidgin.im/viewmtn/revision/info/4be2df4f72bd8a55cdae7f2554b73342a497c92f	[email protected]	Broken Link
http://d.pidgin.im/viewmtn/revision/info/c64a1adc8bda2b4aeaae1f273541afbc4f71b810	[email protected]	Broken Link
http://events.ccc.de/congress/2009/Fahrplan/events/3596.en.html	[email protected]	Product
http://lists.fedoraproject.org/pipermail/package-announce/2010-January/033771.html	[email protected]	Mailing List
http://lists.fedoraproject.org/pipermail/package-announce/2010-January/033848.html	[email protected]	Mailing List
http://lists.opensuse.org/opensuse-security-announce/2010-03/msg00004.html	[email protected]	Mailing List
https://bugzilla.redhat.com/show_bug.cgi?id=552483	[email protected]	Issue TrackingPatch
http://secunia.com/advisories/37953	[email protected]	Broken LinkVendor Advisory
http://secunia.com/advisories/37954	[email protected]	Broken LinkVendor Advisory
http://secunia.com/advisories/37961	[email protected]	Broken Link
http://secunia.com/advisories/38915	[email protected]	Broken Link
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10333	[email protected]	Broken Link
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A17620	[email protected]	Broken Link
http://sunsolve.sun.com/search/document.do?assetkey=1-66-277450-1	[email protected]	Broken Link
http://sunsolve.sun.com/search/document.do?assetkey=1-77-1022203.1-1	[email protected]	Broken Link
http://www.mandriva.com/security/advisories?name=MDVSA-2010:085	[email protected]	Broken Link
http://www.openwall.com/lists/oss-security/2010/01/02/1	[email protected]	Mailing ListPatch
http://www.openwall.com/lists/oss-security/2010/01/07/1	[email protected]	Mailing List
http://www.openwall.com/lists/oss-security/2010/01/07/2	[email protected]	Mailing List
http://www.vupen.com/english/advisories/2009/3662	[email protected]	Permissions RequiredVendor Advisory
http://www.vupen.com/english/advisories/2009/3663	[email protected]	Permissions RequiredVendor Advisory
http://www.vupen.com/english/advisories/2010/1020	[email protected]	Permissions Required

see all 48 references

Weakness Enumeration

CWE-ID	CWE Name	Source
CWE-22	Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')	[email protected]

Affected Products

Product	Versions
adium adium	1.3.8
CPE cpe:2.3:a:adium:adium:1.3.8:::::::* Remediation No remediation found in references.
pidgin pidgin	2.6.4
CPE cpe:2.3:a:pidgin:pidgin:2.6.4:::::::* Remediation No remediation found in references.
fedoraproject fedora	11 12
CPE cpe:2.3:o:fedoraproject:fedora:11:::::::* cpe:2.3:o:fedoraproject:fedora:12:::::::* Remediation No remediation found in references.
opensuse opensuse	>= 11.0, <= 11.2
CPE cpe:2.3:o:opensuse:opensuse:::::::: Remediation No remediation found in references.
suse linux enterprise	11.0 -
CPE cpe:2.3:o:suse:linux_enterprise:11.0:-:::::: Remediation No remediation found in references.
suse linux enterprise server	10 sp2 10 sp3
CPE cpe:2.3:o:suse:linux_enterprise_server:10:sp2:::-:::* cpe:2.3:o:suse:linux_enterprise_server:10:sp3:::-:::* Remediation No remediation found in references.
redhat enterprise linux	4.0 5.0
CPE cpe:2.3:o:redhat:enterprise_linux:4.0:::::::* cpe:2.3:o:redhat:enterprise_linux:5.0:::::::* Remediation No remediation found in references.

Change History

9 change records found show changes

Date	Action	Recorded By
Jun 16, 2026	CVE Modified	[email protected]
Apr 23, 2026	Status Change	[email protected]
Nov 21, 2024	CVE Modified	CVE
May 14, 2024	CVE Modified	[email protected]
Jan 26, 2024	Modified Analysis	[email protected]
Nov 7, 2023	CVE Modified	[email protected]
Feb 13, 2023	CVE Modified	[email protected]
Sep 19, 2017	CVE Modified	[email protected]
Jan 11, 2010	Initial Analysis	[email protected]

CVE-2010-0013 Details

Description

Metrics

References to Advisories, Solutions, and Tools

Weakness Enumeration

Affected Products

CPE

Remediation

CPE

Remediation

CPE

Remediation

CPE

Remediation

CPE

Remediation

CPE

Remediation

CPE

Remediation

Change History

QUICK INFO