Published: 15/01/2016 Updated: 07/12/2016

CVSS v2 Base Score: 5.8 | Impact Score: 4.9 | Exploitability Score: 8.6

CVSS v3 Base Score: 5.4 | Impact Score: 2.5 | Exploitability Score: 2.8

VMScore: 516

Vector: AV:N/AC:M/Au:N/C:P/I:P/A:N

Gajim prior to 0.16.5 allows remote malicious users to modify the roster and intercept messages via a crafted roster-push IQ stanza.

Vulnerable Product	Search on Vulmon	Subscribe to Product
gajim gajim

Debian Bug report logs - #809900 gajim: CVE-2015-8688: Message interception due to unverified origin of roster push Package: src:gajim; Maintainer for src:gajim is Debian XMPP Maintainers <pkg-xmpp-devel@listsaliothdebianorg>; Reported by: Salvatore Bonaccorso <carnil@debianorg> Date: Mon, 4 Jan 2016 19:49:08 UTC ...

Debian Bug report logs - #845258 mcabber: CVE-2016-9928: remote attacker can modify the roster and intercept messages via a crafted roster-push IQ stanza Package: src:mcabber; Maintainer for src:mcabber is Debian XMPP Maintainers <pkg-xmpp-devel@listsaliothdebianorg>; Reported by: Salvatore Bonaccorso <carnil@debianorg ...

CWE-20 http://gultsch.de/gajim_roster_push_and_message_interception.html http://lists.opensuse.org/opensuse-updates/2016-01/msg00027.html https://hg.gajim.org/gajim/file/gajim-0.16.5/ChangeLog http://www.debian.org/security/2016/dsa-3492 http://lists.fedoraproject.org/pipermail/package-announce/2016-January/175503.html http://lists.fedoraproject.org/pipermail/package-announce/2016-January/175526.html https://nvd.nist.gov https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=809900

CVE-2015-8688

Vulnerability Summary

Vendor Advisories

References

Vulmon Search

About

Products

Connect