CVE-2008-2957

Published: Jul 1, 2008Modified: Apr 23, 2026

6.4

Vector

AV:N/AC:L/Au:N/C:N/I:P/A:P

Exploitability: 10.0 / Impact: 4.9

Source: NVD

Description

The UPnP functionality in Pidgin 2.0.0, and possibly other versions, allows remote attackers to trigger the download of arbitrary files and cause a denial of service (memory or disk consumption) via a UDP packet that specifies an arbitrary URL.

Affected (1)

Products: Pidgin: Pidgin

Pidgin

1 product

Pidgin

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Pidgin Pidgin	Version 2.0.0

Related CWEs

CWE-20

Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

References (22)

http://crisp.cs.du.edu/?q=ca2007-1

Source: secalert@redhat.com

http://secunia.com/advisories/32859

Source: secalert@redhat.com

http://secunia.com/advisories/33102

Source: secalert@redhat.com

http://support.avaya.com/elmodocs2/security/ASA-2008-493.htm

Source: secalert@redhat.com

http://www.mandriva.com/security/advisories?name=MDVSA-2009:025

Source: secalert@redhat.com

http://www.openwall.com/lists/oss-security/2008/06/27/3

Source: secalert@redhat.com

http://www.redhat.com/support/errata/RHSA-2008-1023.html

Source: secalert@redhat.com

http://www.securityfocus.com/bid/29985

Source: secalert@redhat.com

http://www.ubuntu.com/usn/USN-675-1

Source: secalert@redhat.com

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A17599

Source: secalert@redhat.com

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9076

Source: secalert@redhat.com

http://crisp.cs.du.edu/?q=ca2007-1