TNCVE-2010-0013 | Vulnetix

TNCVE-2010-0013 PUBLISHED

Record from tenable · Published January 9, 2010

Directory traversal vulnerability in slp.c in the MSN protocol plugin in libpurple in Pidgin 2.6.4 and Adium 1.3.8 allows remote attackers to read arbitrary files via a .. (dot dot) in an application/x-msnmsgrp2p MSN emoticon (aka custom smiley) request, a related issue to CVE-2004-0122. NOTE: it could be argued that this is resultant from a vulnerability in which an emoticon download request is processed even without a preceding text/x-mms-emoticon message that announced availability of the emoticon.

Timeline

Jan 9, 2010 CVE Published

Query this with the API

The same record, from the CLI:

vulnetix vdb vuln TNCVE-2010-0013
vulnetix vdb fixes TNCVE-2010-0013

Or with curl, using the org id and key from your account page:

curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
  "https://api.vdb.vulnetix.com/v2/vuln/TNCVE-2010-0013/fixes/registry"

The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart

References

Tenable: CVE-2010-0013 advisory

Look up in the Resolve Platform →