CVE-2011-3185 — Improper Input Validation in Pidgin

CWE-20 — Improper Input Validation6 documents3 sources
Severity
9.3CRITICALNVD
EPSS
5.1%
top 10.17%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
PidginDebian Pidgin
Timeline
PublishedAug 29
Latest updateMay 17

Description

gtkutils.c in Pidgin before 2.10.0 on Windows allows user-assisted remote attackers to execute arbitrary programs via a file: URL in a message.

CVSS vector

AV:N/AC:M/C:C/I:C/A:CExploitability: 8.6 | Impact: 10.0

Affected Packages2 packages

▶NVDpidgin/pidgin2.9.0+53
▶debiandebian/pidgin

Patches

Patch: developer.pidgin.im ↗Patch: developer.pidgin.im ↗Patch: pidgin.im ↗

🔴Vulnerability Details

2
GHSA
GHSA-vrrf-4f63-4j27: gtkutils↗2022-05-17
▶
GHSA
GHSA-qcwp-776m-mf57: gtkutils↗2022-05-14
▶

📋Vendor Advisories

2
Debian
CVE-2013-6486: pidgin - gtkutils.c in Pidgin before 2.10.8 on Windows allows user-assisted remote attack...↗2013
▶
Debian
CVE-2011-3185: pidgin - gtkutils.c in Pidgin before 2.10.0 on Windows allows user-assisted remote attack...↗2011
▶