Important: Red Hat Security Advisory: Red Hat JBoss BRMS 6.0.2 update

Red Hat JBoss BRMS 6.0.2, which fixes multiple security issues, various bugs, and adds enhancements, is now available from the Red Hat Customer Portal. The Red Hat Security Response Team has rated this update as having Important security impact. Common Vulnerability Scoring System CVSS base score...

Important: Red Hat Security Advisory: Red Hat JBoss BPM Suite 6.0.2 update

Red Hat JBoss BPM Suite 6.0.2, which fixes multiple security issues, various bugs, and adds enhancements, is now available from the Red Hat Customer Portal. The Red Hat Security Response Team has rated this update as having Important security impact. Common Vulnerability Scoring System CVSS base...

openSUSE Security Update : finch (openSUSE-SU-2012:0066-1)

Remote users could crash pidgin via ICQ, SILC, XMPP and Yahoo protocols CVE-2011-4601, CVE-2011-4603, CVE-2011-4602, CVE-2011-1091. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from openSUSE Security Update finch-5557...

openSUSE Security Update : pidgin / pidgin-branding-openSUSE (openSUSE-SU-2014:0239-1)

Update to version 2.10.8 bnc861019 : + General: Python build scripts and example plugins are now compatible with Python 3 pidgin.im15624. + libpurple : - Fix potential crash if libpurple gets an error attempting to read a reply from a STUN server CVE-2013-6484. - Fix potential crash parsing a...

XMPP Makes Encryption Mandatory for Instant Messaging Service Operators

The most popular open source Instant messaging application based on the ‘Extensible Messaging and Presence Protocol’ XMPP, formerly known as Jabber that enables you to connect with other people over the Internet will begin refusing unencrypted connections as from today. In an announcement...

XMPP Mandating Encryption on Messaging Service Operators

Beginning today, the operators of instant messaging services that rely on the extensible messaging and presence protocol XMPP are expected to deploy encryption into the platforms they maintain. The XMPP Standard Foundation XSF announced today that a large number of services on the public XMPP...

Fedora Update for prosody FEDORA-2014-5586

Check for the Version of prosody OpenVAS Vulnerability Test Fedora Update for prosody FEDORA-2014-5586 Authors: System Generated Check Copyright: Copyright C 2014 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it and/or modify it under the...

[SECURITY] [DSA 2895-1] prosody security update

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 - ------------------------------------------------------------------------- Debian Security Advisory DSA-2895-1 [email protected] http://www.debian.org/security/ Luciano Bello April 06, 2014 http://www.debian.org/security/faq -...

Fedora 19 : prosody-0.8.2-11.fc19 (2014-5586)

Added upstream patches to avoid resource consumption denial of service when using XMPP application-layer compression 1085692 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean an...

[SECURITY] Fedora 19 Update: prosody-0.8.2-11.fc19

Prosody is a flexible communications server for Jabber/XMPP written in Lua. It aims to be easy to use, and light on resources. For developers it aims to be easy to extend and give a flexible system on which to rapidly develop added functionality, or prototype new protocols...

CVE-2014-0364

The ParseRoster component in the Ignite Realtime Smack XMPP API before 4.0.0-rc1 does not verify the from attribute of a roster-query IQ stanza, which allows remote attackers to spoof IQ responses via a crafted attribute...

Design/Logic Flaw

The ServerTrustManager component in the Ignite Realtime Smack XMPP API before 4.0.0-rc1 does not verify basicConstraints and nameConstraints in X.509 certificate chains from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted...

Design/Logic Flaw

The ParseRoster component in the Ignite Realtime Smack XMPP API before 4.0.0-rc1 does not verify the from attribute of a roster-query IQ stanza, which allows remote attackers to spoof IQ responses via a crafted attribute...

CVE-2014-0363

CVE-2014-0363 affects Ignite Realtime Smack XMPP API: ServerTrustManager fails to verify basicConstraints and nameConstraints in X.509 certificate chains from SSL servers, enabling MITM spoofing of servers and potential data leakage. The vulnerability is in the Smack API prior to 4.0.0-rc1. Remed...

CVE-2014-0364

CVE-2014-0364 affects Ignite Realtime Smack XMPP API: the ParseRoster component does not verify the From attribute of a roster-query IQ stanza, enabling remote spoofing of IQ responses. Documented in multiple sources (NVD entry and vendor advisories) and corroborated by Red Hat and IBM security b...

CVE-2014-0364

The ParseRoster component in the Ignite Realtime Smack XMPP API before 4.0.0-rc1 does not verify the from attribute of a roster-query IQ stanza, which allows remote attackers to spoof IQ responses via a crafted attribute...

Ignite Realtime Smack XMPP API contains multiple vulnerabilities

Overview Ignite Realtime's Smack XMPP API ServerTrustManger trusts unauthorized SSL certificates CWE-358 and IQ requests do not verify the from attribute allowing anyone to spoof IQ responses. CWE-345 Description CWE-358:Improperly Implemented Security Check for Standard- CVE-2014-0363 The...

SSL/TLS: XMPP 'STARTTLS' Extension Detection

Checks if the remote XMPP server/client supports SSL/TLS with the Copyright C 2014 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free...

[SECURITY] [DSA 2895-2] prosody regression update

------------------------------------------------------------------------- Debian Security Advisory DSA-2895-2 [email protected] http://www.debian.org/security/ Luciano Bello April 21, 2014 http://www.debian.org/security/faq -...

Openfire contains an uncontrolled resource consumption vulnerability

Overview Openfire 3.9.1, and possibly earlier versions, contains an uncontrolled resource consumption CWE-400 vulnerability when using XMPP DEFLATE message compression. Description Openfire 3.9.1, and possibly earlier versions, contains an uncontrolled resource consumption CWE-400 vulnerability...