A vulnerability in Gajim might allow remote attackers to intercept encrypted communications.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| net-im/gajim | * | < 0.16.6-r1 | >= 0.16.6-r1 |
Gajim is a Jabber/XMPP client which uses GTK+.
Gajim unconditionally implements the “XEP-0146: Remote Controlling Clients” extension.
Remote attackers, by enticing a user to connect to a malicious XMPP server, could extract plaintext from Off The Record (OTR) encrypted sessions.
There is no known workaround at this time.
All Gajim users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=net-im/gajim-0.16.6-r1"
An error in Gajim causes invalid OpenSSL certificates to be accepted as valid.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| net-im/gajim | * | < 0.15.3-r1 | >= 0.15.3-r1 |
Gajim is a Jabber/XMPP client which uses GTK+.
The _ssl_verify_callback() function in tls_nb.py does not properly validate SSL certificates, causing any certificate to be accepted as valid as long as the root CA is valid.
A remote attacker might employ a specially crafted certificate to conduct man-in-the-middle attacks on SSL connections and potentially disclose sensitive information.
There is no known workaround at this time.
All Gajim users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=net-im/gajim-0.15.3-r1"
Multiple vulnerabilities have been found in Gajim, the worst of which may allow execution of arbitrary code.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| net-im/gajim | * | < 0.15-r1 | >= 0.15-r1 |
Gajim is a Jabber and XMPP client written in PyGTK.
Multiple vulnerabilities have been discovered in Gajim. Please review the CVE identifiers referenced below for details.
A remote attacker could entice a user to open a specially crafted link using Gajim, possibly resulting in execution of arbitrary code with the privileges of the process or a Denial of Service condition. Furthermore, a remote attacker could use a specially crafted Jabber ID, possibly resulting in execution of arbitrary SQL statements.
A local attacker could perform symlink attacks to overwrite arbitrary files with the privileges of the user running the application.
There is no known workaround at this time.
All Gajim users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=net-im/gajim-0.15-r1"