Lucene search

K
osvGoogleOSV:DSA-2453-2
HistoryApr 16, 2012 - 12:00 a.m.

gajim - regression

2012-04-1600:00:00
Google
osv.dev
4

7.5 High

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

0.012 Low

EPSS

Percentile

83.6%

Several vulnerabilities have been discovered in Gajim, a feature-rich
Jabber client. The Common Vulnerabilities and Exposures project
identifies the following problems:

  • CVE-2012-1987
    Gajim is not properly sanitizing input before passing it to shell
    commands. An attacker can use this flaw to execute arbitrary code
    on behalf of the victim if the user e.g. clicks on a specially crafted
    URL in an instant message.
  • CVE-2012-2093
    Gajim is using predictable temporary files in an insecure manner when
    converting instant messages containing LaTeX to images. A local
    attacker can use this flaw to conduct symlink attacks and overwrite
    files the victim has write access to.
  • CVE-2012-2086
    Gajim is not properly sanitizing input when logging conversations
    which results in the possibility to conduct SQL injection attacks.

For the stable distribution (squeeze), this problem has been fixed in
version 0.13.4-3+squeeze3.

For the testing distribution (wheezy), this problem has been fixed in
version 0.15-1.

For the unstable distribution (sid), this problem has been fixed in
version 0.15-1.

We recommend that you upgrade your gajim packages.

7.5 High

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

0.012 Low

EPSS

Percentile

83.6%

Related for OSV:DSA-2453-2