Vulnerabilities

TI-2017-13411 CVE-2017-18226 · GHSA-6mhg-qh56-v8jg

The Gentoo net-im/jabberd2 package through 2.6.1 sets the ownership of /var/run/jabber to…

LOW 24

The Gentoo net-im/jabberd2 package through 2.6.1 sets the ownership of /var/run/jabber to the jabber account, which might allow local users to kill arbitrary processes by leveraging access to this account for PID file mo…

CVSS 3.0MEDIUM 5.5 Local Low privileges No interaction EPSS 0.00254 Published 2018-03-12 No fix listed CWE-732

TI-2017-13410 CVE-2017-18225 · GHSA-q65j-7f6h-c2fh

The Gentoo net-im/jabberd2 package through 2.6.1 installs jabberd, jabberd2-c2s…

LOW 34

The Gentoo net-im/jabberd2 package through 2.6.1 installs jabberd, jabberd2-c2s, jabberd2-router, jabberd2-s2s, and jabberd2-sm in /usr/bin owned by the jabber account, which might allow local users to gain privileges by…

CVSS 3.0HIGH 7.8 Local Low privileges No interaction EPSS 0.00269 Published 2018-03-12 No fix listed CWE-732

TI-2017-07910 CVE-2017-10807 · GHSA-cv95-3vq8-8f64

JabberD 2.x (aka jabberd2) before 2.6.1 allows anyone to authenticate using SASL…

MEDIUM 47

JabberD 2.x (aka jabberd2) before 2.6.1 allows anyone to authenticate using SASL ANONYMOUS, even when the sasl.anonymous c2s.xml option is not enabled.

CVSS 3.0CRITICAL 9.8 Network No auth No interaction EPSS 0.02812 Published 2017-07-04 Will not fix CWE-287

TI-2015-01845 CVE-2015-2058 · GHSA-qvcf-rgf7-ff3j

c2s/c2s.c in Jabber Open Source Server 2.3.2 and earlier truncates data without ensuring…

LOW 33

c2s/c2s.c in Jabber Open Source Server 2.3.2 and earlier truncates data without ensuring it remains valid UTF-8, which allows remote authenticated users to read system memory or possibly have other unspecified impact via…

CVSS 2.0MEDIUM 6.5 Network Low privileges Interaction — EPSS 0.01908 Published 2015-08-12 Will not fix CWE-200

TI-2012-03053 CVE-2012-3525 · GHSA-f2gg-g599-6m5f

s2s/out.c in jabberd2 2.2.16 and earlier does not verify that a request was made for an…

LOW 30

s2s/out.c in jabberd2 2.2.16 and earlier does not verify that a request was made for an XMPP Server Dialback response, which allows remote XMPP servers to spoof domains via a (1) Verify Response or (2) Authorization Resp…

CVSS 2.0MEDIUM 5.8 Network No auth Interaction — EPSS 0.0173 Published 2012-08-25 Fixed CWE-20

TI-2011-01534 CVE-2011-1755 · GHSA-rpcf-xw9j-7c7j

jabberd2 before 2.2.14 does not properly detect recursion during entity expansion, which…

LOW 39

jabberd2 before 2.2.14 does not properly detect recursion during entity expansion, which allows remote attackers to cause a denial of service (memory and CPU consumption) via a crafted XML document containing a large num…

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.03659 Published 2011-06-21 Fixed CWE-776