Is CVE-2010-0013 being actively exploited?

CVE-2010-0013 is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.

What is the CVSS score for CVE-2010-0013?

CVE-2010-0013 has a CVSS 3.1 base score of 7.5 (HIGH).

CVE-2010-0013

HIGH · CVSS 7.5EPSS 12.5%EU EUVD

Directory traversal vulnerability in slp.c in the MSN protocol plugin in libpurple in Pidgin 2.6.4 and Adium 1.3.8 allows remote attackers to read arbitrary files via a .. (dot dot) in an application/x-msnmsgrp2p MSN emoticon (aka custom smiley) request, a related issue to CVE-2004-0122. NOTE: it could be argued that this is resultant from a vulnerability in which an emoticon download request is processed even without a preceding text/x-mms-emoticon message that announced availability of the emoticon.

Key facts

CVSS score: 7.5 (v3.1)
Severity: HIGH
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weakness (CWE): CWE-22
EPSS score: 12.5% (96th percentile)
In CISA KEV: No
In EU EUVD: Yes (EUVD-2010-0045)
Published: January 9, 2010
NVD last modified: June 16, 2026
Status: Modified

EU Vulnerability Database (EUVD)

This vulnerability is also tracked by ENISA as EUVD-2010-0045 in the EU Vulnerability Database. Last updated in EUVD on August 7, 2024.

View on the EU Vulnerability Database

Affected products

adium / adium
fedoraproject / fedora
fedoraproject / fedora
opensuse / opensuse
pidgin / pidgin
redhat / enterprise linux
redhat / enterprise linux
suse / linux enterprise
suse / linux enterprise server
suse / linux enterprise server

Certified products that may be affected

14 FIPS 140 or Common Criteria certified products, from automated matching by sec-certs.org.

Red Hat Enterprise Linux Kernel Crypto API Cryptographic Module v4.0 with CPACF - Red Hat®, Inc. - FIPS 140 2798 - historical
Red Hat Enterprise Linux Kernel Crypto API Cryptographic Module v4.0 - Red Hat®, Inc. - FIPS 140 2742 - historical
Red Hat Enterprise Linux Libreswan Cryptographic Module v4.0 - Red Hat®, Inc. - FIPS 140 2721 - historical
Red Hat Enterprise Linux NSS Cryptographic Module v4.0 - Red Hat®, Inc. - FIPS 140 2711 - historical
Red Hat Enterprise Linux libgcrypt Cryptographic Module v4.0 [1] and Red Hat Enterprise Linux libgcrypt Cryptographic Module v5.0 [2] - Red Hat®, Inc. - FIPS 140 2657 - historical

See all 14 in the Security Certifications Explorer.

References

http://d.pidgin.im/viewmtn/revision/info/3d02401cf232459fc80c0837d31e05fae7ae5467(Broken Link)
http://d.pidgin.im/viewmtn/revision/info/4be2df4f72bd8a55cdae7f2554b73342a497c92f(Broken Link)
http://d.pidgin.im/viewmtn/revision/info/c64a1adc8bda2b4aeaae1f273541afbc4f71b810(Broken Link)
http://developer.pidgin.im/viewmtn/revision/diff/3d02401cf232459fc80c0837d31e05fae7ae5467/with/c64a1adc8bda2b4aeaae1f273541afbc4f71b810/libpurple/protocols/msn/slp.c(Broken Link)
http://events.ccc.de/congress/2009/Fahrplan/events/3596.en.html(Product)
http://lists.fedoraproject.org/pipermail/package-announce/2010-January/033771.html(Mailing List)
http://lists.fedoraproject.org/pipermail/package-announce/2010-January/033848.html(Mailing List)
http://lists.opensuse.org/opensuse-security-announce/2010-03/msg00004.html(Mailing List)
http://secunia.com/advisories/37953(Broken Link, Vendor Advisory)
http://secunia.com/advisories/37954(Broken Link, Vendor Advisory)
http://secunia.com/advisories/37961(Broken Link)
http://secunia.com/advisories/38915(Broken Link)
http://sunsolve.sun.com/search/document.do?assetkey=1-66-277450-1(Broken Link)
http://sunsolve.sun.com/search/document.do?assetkey=1-77-1022203.1-1(Broken Link)
http://www.mandriva.com/security/advisories?name=MDVSA-2010:085(Broken Link)
http://www.openwall.com/lists/oss-security/2010/01/02/1(Mailing List, Patch)
http://www.openwall.com/lists/oss-security/2010/01/07/1(Mailing List)
http://www.openwall.com/lists/oss-security/2010/01/07/2(Mailing List)
http://www.vupen.com/english/advisories/2009/3662(Permissions Required, Vendor Advisory)
http://www.vupen.com/english/advisories/2009/3663(Permissions Required, Vendor Advisory)
http://www.vupen.com/english/advisories/2010/1020(Permissions Required)
https://bugzilla.redhat.com/show_bug.cgi?id=552483(Issue Tracking, Patch)
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10333(Broken Link)
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A17620(Broken Link)

Last updated September 17, 2026 · Source: NVD, CISA KEV, FIRST.org EPSS

Query CVEs from your AI assistant

The CVE/NVD Explorer brain answers CVE questions directly inside Claude, ChatGPT, or any MCP assistant — always up to date, no setup. Add it once and stop pasting advisories into chat.

Add the CVE brain