4.3

CVE-2007-4999

libpurple in Pidgin 2.1.0 through 2.2.1, when using HTML logging, allows remote attackers to cause a denial of service (NULL dereference and application crash) via a message that contains invalid HTML data, a different vector than CVE-2007-4996.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Pidgin ≫ Pidgin Version2.1.0
Pidgin ≫ Pidgin Version2.2.0
Pidgin ≫ Pidgin Version2.2.1
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 1.81% 0.758
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 4.3 8.6 2.9
AV:N/AC:M/Au:N/C:N/I:N/A:P
CWE-20 Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

http://osvdb.org/38695
http://secunia.com/advisories/27372
Patch
Vendor Advisory
http://secunia.com/advisories/27495
http://secunia.com/advisories/27858
http://www.pidgin.im/news/security/?id=24
Patch
http://www.securityfocus.com/archive/1/483580/100/0/threaded
http://www.securityfocus.com/bid/26205
http://www.ubuntu.com/usn/usn-548-1
http://www.vupen.com/english/advisories/2007/3624
https://exchange.xforce.ibmcloud.com/vulnerabilities/38132
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A18357
https://www.redhat.com/archives/fedora-package-announce/2007-November/msg00011.html