Debian Linux Security Advisory 3492-1 - Daniel Gultsch discovered in Gajim, an XMPP/jabber client. Gajim didn't verify the origin of roster update, allowing an attacker to spoof them and potentially allowing her to intercept messages.
6458ae433eb2d65cf2336d02a0482c8bb4abd3984d7aca3b17a9f73a7114422b