CVE-2016-9928 MCabber before 1.0.4 is vulnerable to roster push attacks, which allows remote attackers to intercept communications, or add themselves as an entity on a 3rd party's roster as another user, which will...
HighCVSS 7.4
EPSS 4.5%
- Published
- Updated
- Exploit status
- No public exploit known
Description
MCabber before 1.0.4 is vulnerable to roster push attacks, which allows remote attackers to intercept communications, or add themselves as an entity on a 3rd party's roster as another user, which will also garner associated privileges, via crafted XMPP packets.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/mcabber(Debian:12) | < 0.10.2-1.1 | 0.10.2-1.1 |
| debian/mcabber(Debian:13) | < 0.10.2-1.1 | 0.10.2-1.1 |
| mcabber | >= 1.0.0, < 1.0.4 | 1.0.4 |
| Canonical Ubuntu Linux | = 16.04 | No fix listed |
| debian linux | = 8.0 | No fix listed |
| mcabber | = before 1.0.4 | No fix listed |
References
- Debian Security Tracker CVE-2016-9928 vendor-advisory
- lists.opensuse.org mailing-list third-party-advisory
- www.openwall.com mailing-list third-party-advisory
- www.openwall.com mailing-list third-party-advisory
- www.securityfocus.com third-party-advisory vdb-entry
- bitbucket.org patch third-party-advisory
- bugs.debian.org exploit third-party-advisory
- bugzilla.redhat.com exploit issue-tracking third-party-advisory
- gultsch.de third-party-advisory
- [debian-lts-announce] 20200628 [SECURITY] [DLA 2260-1] mcabber security update mailing-list third-party-advisory
- USN-4506-1 third-party-advisory vendor-advisory
- bugs.debian.org issue-tracking