CVE-2009-3026
CVE-2009-3026
Cette page présente des faits issus de sources publiques. Consultez l’avis original avant toute mise à jour.
protocols/jabber/auth.c in libpurple in Pidgin 2.6.0, and possibly other versions, does not follow the "require TLS/SSL" preference when connecting to older Jabber servers that do not follow the XMPP specification, which causes libpurple to connect to the server without the expected encryption and allows remote attackers to sniff sessions.
EPSS 1,3% · Correctif disponible
- Publication
- Mise à jour
Pile logicielle: system
Produits et versions concernés
n/a
- Versions du logiciel
- n/a: Concernée
Aucun correctif publié
pidgin Debian:12
- Plages de versions concernées
- ECOSYSTEM: < 2.6.1-1
Mettez à jour vers 2.6.1-1
pidgin Debian:13
- Plages de versions concernées
- ECOSYSTEM: < 2.6.1-1
Mettez à jour vers 2.6.1-1
pidgin Debian:14
- Plages de versions concernées
- ECOSYSTEM: < 2.6.1-1
Mettez à jour vers 2.6.1-1
Sources originales
- http://www.securityfocus.com/bid/36368
- http://developer.pidgin.im/viewmtn/revision/diff/312e056d702d29379ea61aea9d27765f127bc888/with/55897c4ce0787edc1e7721b7f4a9b5cbc8357279
- http://developer.pidgin.im/ticket/8131
- http://secunia.com/advisories/37071
- http://www.openwall.com/lists/oss-security/2009/08/24/2
- http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=542891
- https://exchange.xforce.ibmcloud.com/vulnerabilities/53000
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5757
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11070
- https://nvd.nist.gov/vuln/detail/CVE-2009-3026