Pidgin CVE-2013-6486 Incomplete Fix Remote Code Execution Vulnerability

Bugtraq ID:	65189
Class:	Design Error
CVE:	CVE-2013-6486
Remote:	Yes
Local:	No
Published:	Jan 28 2014 12:00AM
Updated:	Aug 05 2014 08:39AM
Credit:	Yves Younan of Sourcefire VRT
Vulnerable:	Slackware Slackware Linux 13.37 Slackware Slackware Linux 13.1 Slackware Slackware Linux 13.0 MandrakeSoft Enterprise Server 5 x86_64 MandrakeSoft Enterprise Server 5
Not Vulnerable:

Pidgin CVE-2013-6486 Incomplete Fix Remote Code Execution Vulnerability

Pidgin is prone to a remote code-execution vulnerability.

An attacker can exploit this issue to execute arbitrary code with the privileges of the user or to crash the application.

Note: This issue exists due to an incomplete fix for CVE-2011-3185 (identified in BID 49268 - Pidgin Denial of Service and Security Bypass Vulnerabilities).

Pidgin 2.10.7 is vulnerable; other versions may also be affected.

Pidgin CVE-2013-6486 Incomplete Fix Remote Code Execution Vulnerability

Currently, we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Pidgin CVE-2013-6486 Incomplete Fix Remote Code Execution Vulnerability

Solution:
Updates are available. Please see the references or vendor advisory for more information.

Pidgin CVE-2013-6486 Incomplete Fix Remote Code Execution Vulnerability

References:

• Pidgin Homepage (Pidgin)