CVE-2013-6483 Null dereference in n/a
Remote attackers can crash Pidgin or spoof XMPP traffic via crafted IQ replies due to improper address validation in libpurple.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2013-6483?
CVE-2013-6483 is a medium-severity vulnerability in Pidgin Pidgin, published on 6 Feb 2014. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The XMPP protocol plugin in libpurple in Pidgin before 2.10.8 does not properly determine whether the from address in an iq reply is consistent with the to address in an iq request, which allows remote attackers to spoof iq traffic or cause a denial of service (NULL pointer dereference and application crash) via a crafted reply.
Weakness: CWE-20
Which versions are affected by CVE-2013-6483?
It affects 1 product.
Products include Pidgin Pidgin.
How do I fix CVE-2013-6483?
Upgrade to a fixed version.
Is CVE-2013-6483 being exploited?
There is no known exploitation of CVE-2013-6483 in the wild and no public exploit code.
Other vulnerabilities in Pidgin Pidgin
Sources
Also known as DEBIAN-CVE-2013-6483, GHSA-7hf8-wq8c-mrxp.