1261 matches found
CVE-2014-2741: Undefined Security Weakness
nio/XMLLightweightParser.java in Ignite Realtime Openfire before 3.9.2 does not properly restrict the processing of compressed XML elements, which allows remote attackers to cause a denial of service resource consumption via a crafted XMPP stream, aka an "xmppbomb" attack...
PT-2014-4899
Name of the Vulnerable Software and Affected Versions Prosody versions prior to 0.9.4 Lightwitch Metronome versions prior to 3.5 Description The issue allows remote attackers to cause a denial of service due to resource consumption via compressed XML elements in an XMPP stream. This type of attac...
PT-2014-4901
Name of the Vulnerable Software and Affected Versions Tigase versions prior to 5.2.1 Description The issue allows remote attackers to cause a denial of service due to excessive resource consumption via a crafted XMPP stream, also known as an "xmppbomb" attack. This occurs because the...
Debian DSA-2895-1 : prosody - security update
A denial-of-service vulnerability has been reported in Prosody, a XMPP server. If compression is enabled, an attacker might send highly-compressed XML elements attack known as 'zip bomb' over XMPP streams and consume all the resources of the server. The SAX XML parser lua-expat is also affected b...
Debian Security Advisory DSA 2895-1 (prosody - security update)
A denial-of-service vulnerability has been reported in Prosody, a XMPP server. If compression is enabled, an attacker might send highly-compressed XML elements attack known as zip bomb over XMPP streams and consume all the resources of the server. The SAX XML parser lua-expat is also affected by...
DSA-2895-1 prosody - security update
Bulletin has no description...
[SECURITY] [DSA 2895-1] prosody security update
------------------------------------------------------------------------- Debian Security Advisory DSA-2895-1 [email protected] http://www.debian.org/security/ Luciano Bello April 06, 2014 http://www.debian.org/security/faq -...
Internet Bug Bounty: Uncontrolled Resource Consumption with XMPP-Layer Compression
The bug information described below is based on a publicly available security notice here http://xmpp.org/resources/security-notices/uncontrolled-resource-consumption-with-highly-compressed-xmpp-stanzas/ These discoveries are part of the results of my research activities. OVERVIEW...
Debian: Security Advisory (DSA-2895-1)
The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2014 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
Debian DSA-2859-1 : pidgin - several vulnerabilities
Multiple vulnerabilities have been discovered in Pidgin, a multi-protocol instant messaging client : - CVE-2013-6477 Jaime Breva Ribes discovered that a remote XMPP user can trigger a crash by sending a message with a timestamp in the distant future. - CVE-2013-6478 Pidgin could be crashed throug...
CentOS Update for finch CESA-2014:0139 centos5
Check for the Version of finch OpenVAS Vulnerability Test CentOS Update for finch CESA-2014:0139 centos5 Authors: System Generated Check Copyright: Copyright C 2014 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it and/or modify it under the...
Ubuntu: Security Advisory (USN-2100-1)
The remote host is missing an update for the SPDX-FileCopyrightText: 2014 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
libgadu / libpurple / Pidgin multiple security vulnerabilities
Buffer overflow on libgadu protocol parsing. Yahoo!, XMPP, MSN, HTTP, STUN, IRC protocols and URL parsing DoS. HTTP, SIMPLE protocols and MXit emoticons parsing memory corruptions...
Ubuntu 12.04 LTS / 12.10 / 13.10 : pidgin vulnerabilities (USN-2100-1)
Thijs Alkemade and Robert Vehse discovered that Pidgin incorrectly handled the Yahoo! protocol. A remote attacker could use this issue to cause Pidgin to crash, resulting in a denial of service. CVE-2012-6152 Jaime Breva Ribes discovered that Pidgin incorrectly handled the XMPP protocol. A remote...
DEBIAN-CVE-2013-6483
The XMPP protocol plugin in libpurple in Pidgin before 2.10.8 does not properly determine whether the from address in an iq reply is consistent with the to address in an iq request, which allows remote attackers to spoof iq traffic or cause a denial of service NULL pointer dereference and...
CVE-2013-6483
The XMPP protocol plugin in libpurple in Pidgin before 2.10.8 does not properly determine whether the from address in an iq reply is consistent with the to address in an iq request, which allows remote attackers to spoof iq traffic or cause a denial of service NULL pointer dereference and...
CVE-2013-6477
Multiple integer signedness errors in libpurple in Pidgin before 2.10.8 allow remote attackers to cause a denial of service application crash via a crafted timestamp value in an XMPP message...
CVE-2013-6483
The XMPP protocol plugin in libpurple in Pidgin before 2.10.8 does not properly determine whether the from address in an iq reply is consistent with the to address in an iq request, which allows remote attackers to spoof iq traffic or cause a denial of service NULL pointer dereference and...
Integer overflow
Multiple integer signedness errors in libpurple in Pidgin before 2.10.8 allow remote attackers to cause a denial of service application crash via a crafted timestamp value in an XMPP message...
Null pointer dereference
The XMPP protocol plugin in libpurple in Pidgin before 2.10.8 does not properly determine whether the from address in an iq reply is consistent with the to address in an iq request, which allows remote attackers to spoof iq traffic or cause a denial of service NULL pointer dereference and...