CVE-2014-3697

Absolute path traversal vulnerability in the untar_block function in win32/untar.c in Pidgin before 2.10.10 on Windows allows remote…

6.4MediumCVSS base score
3.8%Exploitation in 30 daysEPSS · top 9.8% of all CVEs
NoKnown exploitednot in CISA's KEV catalog
NonePublic exploitsnone known yet

Description

Absolute path traversal vulnerability in the untar_block function in win32/untar.c in Pidgin before 2.10.10 on Windows allows remote attackers to write to arbitrary files via a drive name in a tar archive of a smiley theme.

Timeline

2014
14 May 2014
14 May 2014
ID reserved
By redhat
29 Oct 20146 months later
29 Oct 2014· 6 months later
Published
2024
6 Aug 202410 years later
6 Aug 2024· 10 years later
Record updated

Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.

Scores

CVSS scores of CVE-2014-3697, by who scored it
Scored by	CVSS	Score	Vector
NVDNVD · Modified	2.0	Medium6.4	AV:N/AC:L/Au:N/C:N/I:P/A:P

EPSS (exploitation in 30 days): 3.8% · top 9.8% of all CVEs (9 Nov 2026)

The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 6.4.

Affected products

n/a
- affected n/a

References

http://pidgin.im/news/security/?id=89 (opens in a new tab)x_refsource_CONFIRMx_transferred
openSUSE-SU-2014:1376 (opens in a new tab)vendor-advisoryx_refsource_SUSEx_transferred
openSUSE-SU-2014:1397 (opens in a new tab)vendor-advisoryx_refsource_SUSEx_transferred
http://hg.pidgin.im/pidgin/main/rev/68b8eb10977f (opens in a new tab)x_refsource_CONFIRMx_transferred

Sources

The same CVE in the primary databases and aggregators, to check against.

Badge for a README or a ticket

[![CVE-2014-3697](https://cveledger.app/badge/CVE-2014-3697.svg)](https://cveledger.app/cve/CVE-2014-3697)

Record last updated 6 Aug 2024, 10:50 UTC.