CVE-2012-1257
Publication date 20 November 2019
Last updated 25 August 2025
Ubuntu priority
Description
Pidgin 2.10.0 uses DBUS for certain cleartext communication, which allows local users to obtain sensitive information via a dbus session monitor.
Status
| Package | Ubuntu Release | Status |
|---|---|---|
| pidgin | ||
| 14.04 LTS trusty | Ignored upstream wontfix | |
Notes
sbeattie
libpurple exposes private comms over local session dbus. This is a legitimate issue for desktop application isolation
Severity score breakdown
| Parameter | Value |
|---|---|
| Base score |
5.5 · Medium
|
| Attack vector | Local |
| Attack complexity | Low |
| Privileges required | Low |
| User interaction | None |
| Scope | Unchanged |
| Confidentiality | High |
| Integrity impact | None |
| Availability impact | None |
| Vector | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N |