what you don't know can hurt you
Home Files News &[SERVICES_TAB]About Contact Add New

Debian Security Advisory 2453-1

Debian Security Advisory 2453-1
Posted Apr 16, 2012
Authored by Debian | Site debian.org

Debian Linux Security Advisory 2453-1 - Several vulnerabilities have been discovered in gajim, a feature-rich jabber client.

tags | advisory, vulnerability
systems | linux, debian
advisories | CVE-2012-2093, CVE-2012-2086, CVE-2012-2085
SHA-256 | bd105df7fba5991e582b3c8ae56d9c2086f0b1c465a2185562b29411c942cbb9

Debian Security Advisory 2453-1

Change Mirror Download
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

- -------------------------------------------------------------------------
Debian Security Advisory DSA-2453-1 security@debian.org
http://www.debian.org/security/ Nico Golde
April 16, 2012 http://www.debian.org/security/faq
- -------------------------------------------------------------------------

Package : gajim
Vulnerability : several
Problem type : remote
Debian-specific: no
CVE IDs : CVE-2012-2093 CVE-2012-2086 CVE-2012-2085
Debian bug : 668038

Several vulnerabilities have been discovered in gajim, a feature-rich
jabber client. The Common Vulnerabilities and Exposures project
identifies the following problems:

CVE-2012-1987

gajim is not properly sanitizing input before passing it to shell
commands. An attacker can use this flaw to execute arbitrary code
on behalf of the victim if the user e.g. clicks on a specially crafted
URL in an instant message.

CVE-2012-2093

gajim is using predictable temporary files in an insecure manner when
converting instant messages containing LaTeX to images. A local
attacker can use this flaw to conduct symlink attacks and overwrite
files the victim has write access to.

CVE-2012-2086

gajim is not properly sanitizing input when logging conversations
which results in the possibility to conduct SQL injection attacks.


For the stable distribution (squeeze), this problem has been fixed in
version 0.13.4-3+squeeze2.

For the testing distribution (wheezy), this problem has been fixed in
version 0.15-1.

For the unstable distribution (sid), this problem has been fixed in
version 0.15-1.

We recommend that you upgrade your gajim packages.

Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: http://www.debian.org/security/

Mailing list: debian-security-announce@lists.debian.org
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.11 (GNU/Linux)

iEYEARECAAYFAk+LrNsACgkQHYflSXNkfP9GKACcDu4Zrmtq5e24RIxQMO2Mt/1J
xxUAn2EN1XxsdvduTN4i/hHzyNpPCEqY
=bkGL
-----END PGP SIGNATURE-----

Login or Register to add favorites

File Archive:

August 2022

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Aug 1st
    20 Files
  • 2
    Aug 2nd
    4 Files
  • 3
    Aug 3rd
    6 Files
  • 4
    Aug 4th
    55 Files
  • 5
    Aug 5th
    16 Files
  • 6
    Aug 6th
    0 Files
  • 7
    Aug 7th
    0 Files
  • 8
    Aug 8th
    13 Files
  • 9
    Aug 9th
    13 Files
  • 10
    Aug 10th
    0 Files
  • 11
    Aug 11th
    0 Files
  • 12
    Aug 12th
    0 Files
  • 13
    Aug 13th
    0 Files
  • 14
    Aug 14th
    0 Files
  • 15
    Aug 15th
    0 Files
  • 16
    Aug 16th
    0 Files
  • 17
    Aug 17th
    0 Files
  • 18
    Aug 18th
    0 Files
  • 19
    Aug 19th
    0 Files
  • 20
    Aug 20th
    0 Files
  • 21
    Aug 21st
    0 Files
  • 22
    Aug 22nd
    0 Files
  • 23
    Aug 23rd
    0 Files
  • 24
    Aug 24th
    0 Files
  • 25
    Aug 25th
    0 Files
  • 26
    Aug 26th
    0 Files
  • 27
    Aug 27th
    0 Files
  • 28
    Aug 28th
    0 Files
  • 29
    Aug 29th
    0 Files
  • 30
    Aug 30th
    0 Files
  • 31
    Aug 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Hosting By
Rokasec
close