Pidgin 'gg_http_watch_fd()' Function Buffer Overflow Vulnerability

Bugtraq ID:	65188
Class:	Boundary Condition Error
CVE:	CVE-2013-6487
Remote:	Yes
Local:	No
Published:	Jan 27 2014 12:00AM
Updated:	Nov 03 2015 07:02PM
Credit:	VRT VULNDEV team
Vulnerable:	Slackware Slackware Linux 13.37 Slackware Slackware Linux 13.1 Slackware Slackware Linux 13.0 RedHat Enterprise Linux Desktop Workstation 5 client Red Hat Enterprise Linux Workstation Optional 6 Red Hat Enterprise Linux Workstation 6 Red Hat Enterprise Linux Server Optional 6 Red Hat Enterprise Linux Desktop Optional 6 Red Hat Enterprise Linux Desktop 6 Red Hat Enterprise Linux Desktop 5 client Oracle Enterprise Linux 6.2 Oracle Enterprise Linux 6 MandrakeSoft Enterprise Server 5 x86_64 MandrakeSoft Enterprise Server 5 Gentoo Linux Debian Linux 6.0 sparc Debian Linux 6.0 s/390 Debian Linux 6.0 powerpc Debian Linux 6.0 mips Debian Linux 6.0 ia-64 Debian Linux 6.0 ia-32 Debian Linux 6.0 arm Debian Linux 6.0 amd64 CentOS CentOS 5
Not Vulnerable:

Pidgin 'gg_http_watch_fd()' Function Buffer Overflow Vulnerability

Pidgin is prone to a buffer-overflow vulnerability because it fails to perform adequate boundary checks on user-supplied input.

Attackers may leverage this issue to execute arbitrary code in the context of the application. Failed attacks will cause denial-of-service conditions.

Pidgin 2.10.7 is vulnerable; other versions may also be affected.

Pidgin 'gg_http_watch_fd()' Function Buffer Overflow Vulnerability

Attackers can use standard, readily available tools to exploit this issue.

Pidgin 'gg_http_watch_fd()' Function Buffer Overflow Vulnerability

Solution:
Updates are available. Please see the references or vendor advisory for more information.

Pidgin 'gg_http_watch_fd()' Function Buffer Overflow Vulnerability

References:

• Pidgin Homepage (Pidgin)