[SECURITY] Fedora 26 Update: gajim-0.16.8-1.fc26

Gajim is a Jabber client written in PyGTK. The goal of Gajim's developers is to provide a full featured and easy to use xmpp client for the GTK+ users. Gajim does not require GNOME to run, even though it exists with it nicely...

Updated gajim packages fix security vulnerability

Gajim unconditionally implements the "XEP-0146: Remote Controlling Clients" extension, which may be abused by malicious XMPP servers to, for example, extract plaintext from OTR encrypted sessions CVE-2016-10376...

MGASA-2017-0166 Updated gajim packages fix security vulnerability

Gajim unconditionally implements the "XEP-0146: Remote Controlling Clients" extension, which may be abused by malicious XMPP servers to, for example, extract plaintext from OTR encrypted sessions CVE-2016-10376...

openSUSE Security Update : gajim (openSUSE-2017-665)

This update for gajim fixes the following issues : - CVE-2016-10376: XEP-0146 extension can be abused by malicious XMPP servers boo1041163. - Update to version 0.16.7 : - Better compatibility with XEP-0191: Blocking Command. - Gajim now depends on python-gnupg for PGP encryption. - Remove usage o...

[ASA-201706-4] gajim: information disclosure

Arch Linux Security Advisory ASA-201706-4 ========================================= Severity: High Date : 2017-06-05 CVE-ID : CVE-2016-1037 Package : gajim Type : information disclosure Remote : Yes Link : https://security.archlinux.org/AVG-284 Summary ======= The package gajim before version...

CVE-2016-10376

Gajim through 0.16.7 unconditionally implements the "XEP-0146: Remote Controlling Clients" extension. This can be abused by malicious XMPP servers to, for example, extract plaintext from OTR encrypted sessions...

Code injection

Gajim through 0.16.7 unconditionally implements the "XEP-0146: Remote Controlling Clients" extension. This can be abused by malicious XMPP servers to, for example, extract plaintext from OTR encrypted sessions...

CVE-2016-10376

Gajim through 0.16.7 unconditionally implements the "XEP-0146: Remote Controlling Clients" extension. This can be abused by malicious XMPP servers to, for example, extract plaintext from OTR encrypted sessions...

CVE-2016-10376

Gajim through 0.16.7 unconditionally implements the "XEP-0146: Remote Controlling Clients" extension. This can be abused by malicious XMPP servers to, for example, extract plaintext from OTR encrypted sessions...

CVE-2016-10376

Gajim through 0.16.7 unconditionally implements the "XEP-0146: Remote Controlling Clients" extension. This can be abused by malicious XMPP servers to, for example, extract plaintext from OTR encrypted sessions...

CVE-2016-10376

Gajim (XMPP client) up to version 0.16.7 unconditionally implements XEP-0146: Remote Controlling Clients, allowing a malicious XMPP server to trigger actions and potentially leak plaintext from OTR sessions. Public advisories (Debian, Gentoo, Fedora) note this behavior and provide patches/mitigat...

yaxim - XMPP/Jabber client - Customized SSL, Exported components, External URLs vulnerabilities

HackApp vulnerability scanner discovered that application yaxim - XMPP/Jabber client published at the 'play' market has multiple vulnerabilities...

[SECURITY] Fedora 25 Update: python-sleekxmpp-1.3.2-1.fc25

SleekXMPP is a flexible XMPP library for python that allows you to create clients, components or servers for the XMPP protocol. Plug-ins can be create to cover every current or future XEP...

[SECURITY] Fedora 24 Update: python-sleekxmpp-1.3.2-1.fc24

SleekXMPP is a flexible XMPP library for python that allows you to create clients, components or servers for the XMPP protocol. Plug-ins can be create to cover every current or future XEP...

[SECURITY] Fedora 26 Update: python-sleekxmpp-1.3.2-1.fc26

SleekXMPP is a flexible XMPP library for python that allows you to create clients, components or servers for the XMPP protocol. Plug-ins can be create to cover every current or future XEP...

[ASA-201702-11] kdenetwork-kopete: content spoofing

Arch Linux Security Advisory ASA-201702-11 ========================================== Severity: Medium Date : 2017-02-12 CVE-ID : CVE-2017-5593 Package : kdenetwork-kopete Type : content spoofing Remote : Yes Link : https://security.archlinux.org/AVG-173 Summary ======= The package...

Social Engineering Attack Via Impersonation

slixmpp and sleekxmpp are vulnerable to social engineering attacks via a loophole leading to impersonation. It happens due to a flaw in the implementation of XEP-0280: Message Carbons in multiple XMPP clients, allowing a malicious user to impersonate any user, including contacts in the vulnerable...

Social Engineering Attacks Via Impersonation

converse.js is vulnerable to various social engineering attacks via a loophole leading to impersonation. It can happen due to a flaw in implementation of XEP-0280: Message Carbons in multiple XMPP clients, allowing malicious user to impersonate any user, including contacts, in the vulnerable...

Xabber User Simulation Vulnerability

Xabber for Android is an XMPP-based live chat OTR client for Android. A user emulation vulnerability exists in XMPP Xabber versions 1.0.30, 1.0.30 VIP and beta 1.0.3 through 1.0.74. Due to the program failing to implement 'XEP-0280: Message Carbons' correctly. A remote attacker can exploit this...

XMPP Clients User Impersonation Vulnerability

Exploit for multiple platform in category local exploits Multiple XMPP Clients User Impersonation Vulnerability Summary ------- An incorrect implementation of XEP-0280: Message Carbons0 in multiple XMPP clients allows a remote attacker to impersonate any user, including contacts, in the vulnerabl...