hugo/content/about/security/advisories/cve-2013-6486-00.md@6532ddaa3587
hugo/content/about/security/advisories/cve-2013-6486-00.md
Sun, 10 Nov 2024 00:47:44 -0600
- author
- Gary Kramlich <grim@reaperworld.com>
- date
- Sun, 10 Nov 2024 00:47:44 -0600
- changeset 544
- 6532ddaa3587
- parent 400
- d5c8285de7f1
- permissions
- -rw-r--r--
Add EionRobb's ChatGPT protocol plugin and update the signal protocol plugins
Testing Done:
Ran `npm run hugo:server` and verified it locally.
Reviewed at https://reviews.imfreedom.org/r/3649/
--- title: cve-2013-6486-00 date: 2014-01-28T00:00:00.000Z cveNumber: cve-2013-6486 summary: Pidgin uses clickable links to untrusted executables discoveredBy: Originally by James Burton, Insomnia Security. Rediscovered by Yves Younan of Sourcefire VRT. fixedInRelease: 2.10.8 type: security layout: cve hidden: true --- ### Description If a user clicks on a file:// URI in a received IM in Windows builds of Pidgin, Pidgin attempts to execute the file. This can be dangerous if the file:// URI is a path on a network share. This was originally reported in [CVE-2011-3185]({{< ref "cve-2011-3185-00" >}}) in 2011 and we attempted to fix it then, but failed. ### Mitigation Don't attempt to execute files when the user clicks a file:// URI. Instead, open a file browser at the file's location.
