Unscored severity · published May 29, 2002
CVE-2002-0377
Gaim 0.57 stores sensitive information in world-readable and group-writable files in the /tmp directory, which allows local users to access MSN web email accounts of other users…
–
CVSS
0.4%
EPSS
No
On KEV
Description
Gaim 0.57 stores sensitive information in world-readable and group-writable files in the /tmp directory, which allows local users to access MSN web email accounts of other users who run Gaim by reading authentication information from the files.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 30% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
GA
Gaim · Rob Flynn
0.57 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2002-0377
CVE.org
https://www.cve.org/CVERecord?id=CVE-2002-0377
archives.neohapsis.com
http://archives.neohapsis.com/archives/vuln-dev/2002-q2/0584.html
Vendor Advisory
http://gaim.sourceforge.net/ChangeLog
marc.info
http://marc.info/?l=bugtraq&m=102130733815285&w=2
www.iss.net
http://www.iss.net/security_center/static/9061.php
www.securityfocus.com
http://www.securityfocus.com/bid/4730
More from Gaim
–
CVE-2005-2102
The AIM/ICQ module in Gaim before 1.5.0 allows remote attackers to cause a denial of service (application crash) via a filename that contains invalid UTF-8 characters
–
CVE-2005-2370
Multiple "memory alignment errors" in libgadu, as used in ekg before 1.6rc2, Gaim before 1.5.0, and other packages, allows remote attackers to cause a denial of service (bus…
–
CVE-2005-1269
Gaim before 1.3.1 allows remote attackers to cause a denial of service (application crash) via a Yahoo! message with non-ASCII characters in a file name
–
CVE-2005-1934
Gaim before 1.3.1 allows remote attackers to cause a denial of service (crash) via a malformed MSN message that leads to a memory allocation of a large size, possibly due to an…
–
CVE-2005-1261
Stack-based buffer overflow in the URL parsing function in Gaim before 1.3.0 allows remote attackers to execute arbitrary code via an instant message (IM) with a large URL