MEDIUM🇵🇱 Wersja polska

CVE-2015-2058

CVSS 6.5v2.0pub. 2015-08-12upd. 2026-05-06

c2s/c2s.c in Jabber Open Source Server 2.3.2 and earlier truncates data without ensuring it remains valid UTF-8, which allows remote authenticated users to read system memory or possibly have other unspecified impact via a crafted JID.

CVSS Vector
AV:N/AC:L/Au:S/C:P/I:P/A:P

  • Jabberd2

    APP
    Jabberd2
    ≤ 2.3.2
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
CWE
References

Related vulnerabilities

CVE-2017-10807CRITICAL9.8ten sam produkt

JabberD 2.x (aka jabberd2) before 2.6.1 allows anyone to authenticate using SASL ANONYMOUS, even when the sasl...

CVE-2017-18225HIGH7.8ten sam produkt

The Gentoo net-im/jabberd2 package through 2.6.1 installs jabberd, jabberd2-c2s, jabberd2-router, jabberd2-s2s...

CVE-2011-1755HIGH7.5ten sam produkt

jabberd2 before 2.2.14 does not properly detect recursion during entity expansion, which allows remote attacke...

CVE-2017-18226MEDIUM5.5ten sam produkt

The Gentoo net-im/jabberd2 package through 2.6.1 sets the ownership of /var/run/jabber to the jabber account, ...

CVE-2012-3525MEDIUM5.8ten sam produkt

s2s/out.c in jabberd2 2.2.16 and earlier does not verify that a request was made for an XMPP Server Dialback r...