Candidate: CVE-2017-5591
PublicDate: 2017-02-09 20:59:00 UTC
References:
 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-5591
 http://openwall.com/lists/oss-security/2017/02/09/29
 https://github.com/poezio/slixmpp/commit/22664ee7b86c8e010f312b66d12590fb47160ad8
 https://rt-solutions.de/en/2017/02/CVE-2017-5589_xmpp_carbons/
 https://rt-solutions.de/wp-content/uploads/2017/02/CVE-2017-5589_xmpp_carbons.pdf
Description:
 An incorrect implementation of "XEP-0280: Message Carbons" in multiple XMPP
 clients allows a remote attacker to impersonate any user, including
 contacts, in the vulnerable application's display. This allows for various
 kinds of social engineering attacks. This CVE is for SleekXMPP up to 1.3.1
 and Slixmpp all versions up to 1.2.3, as bundled in poezio (0.8 - 0.10) and
 other products.
Ubuntu-Description:
Notes:
Bugs:
 http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=854740
 http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=854739
Priority: medium
Discovered-by:
Assigned-to:
CVSS:
 nvd: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N [5.9 MEDIUM]

Patches_slixmpp:
upstream_slixmpp: released (1.2.2-1.1)
precise_slixmpp: DNE
precise/esm_slixmpp: DNE
trusty_slixmpp: DNE
trusty/esm_slixmpp: DNE
vivid/stable-phone-overlay_slixmpp: DNE
vivid/ubuntu-core_slixmpp: DNE
xenial_slixmpp: DNE
yakkety_slixmpp: DNE
zesty_slixmpp: ignored (reached end-of-life)
artful_slixmpp: ignored (reached end-of-life)
bionic_slixmpp: not-affected (1.2.2-1.1build2)
cosmic_slixmpp: not-affected (1.2.2-1.1build2)
disco_slixmpp: not-affected (1.2.2-1.1build2)
eoan_slixmpp: not-affected (1.2.2-1.1build2)
focal_slixmpp: not-affected (1.2.2-1.1build2)
groovy_slixmpp: not-affected (1.2.2-1.1build2)
hirsute_slixmpp: not-affected (1.2.2-1.1build2)
impish_slixmpp: not-affected (1.2.2-1.1build2)
jammy_slixmpp: not-affected (1.2.2-1.1build2)
devel_slixmpp: not-affected (1.2.2-1.1build2)

Patches_sleekxmpp:
upstream_sleekxmpp: released (1.3.1-6)
precise_sleekxmpp: ignored (reached end-of-life)
precise/esm_sleekxmpp: DNE (precise was needed)
trusty_sleekxmpp: not-affected (code not present)
trusty/esm_sleekxmpp: DNE (trusty was not-affected [code not present])
vivid/stable-phone-overlay_sleekxmpp: DNE
vivid/ubuntu-core_sleekxmpp: DNE
xenial_sleekxmpp: ignored (end of standard support, was needed)
yakkety_sleekxmpp: ignored (reached end-of-life)
zesty_sleekxmpp: ignored (reached end-of-life)
artful_sleekxmpp: ignored (reached end-of-life)
bionic_sleekxmpp: not-affected (1.3.3-3)
cosmic_sleekxmpp: not-affected (1.3.3-3)
disco_sleekxmpp: not-affected (1.3.3-3)
eoan_sleekxmpp: not-affected (1.3.3-3)
focal_sleekxmpp: not-affected (1.3.3-3)
groovy_sleekxmpp: not-affected (1.3.3-3)
hirsute_sleekxmpp: not-affected (1.3.3-3)
impish_sleekxmpp: not-affected (1.3.3-3)
jammy_sleekxmpp: not-affected (1.3.3-3)
devel_sleekxmpp: not-affected (1.3.3-3)