Advisories » MGASA-2016-0046

Updated gajim packages fix security vulnerability

Publication date: 05 Feb 2016
Modification date: 07 Mar 2016
Type: security
Affected Mageia releases : 5
CVE: CVE-2015-8688

Description

Gajim before 0.16.5 doesn't verify the origin of roster pushes thus
allowing third parties to modify the roster via a man-in-the-middle attack
(CVE-2015-8688).
                

References

• https://bugs.mageia.org/show_bug.cgi?id=17474
• http://gultsch.de/gajim_roster_push_and_message_interception.html
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-8688

SRPMS

5/core

• gajim-0.16.5-1.mga5
• python-nbxmpp-0.5.3-1.mga5