CVE-2017-5589

MEDIO 5.9CVE-2017-5589 · Published 09/02/2017 · updated 17/06/2026

In breve

CVE-2017-5589 è una vulnerabilità MEDIO (CVSS 5.9) che riguarda bruno (yaxim), yaxim (yaxim).
Probabilità di sfruttamento nei prossimi 30 giorni (EPSS): 0.97%, superiore al 62.3% delle vulnerabilità.
Nessuna versione corretta ancora nota: segui l'avviso del produttore nei riferimenti.

Package	Affected versions	Patched versions
bruno yaxim	`= 0.8.6= 0.8.7= 0.8.8`	No fix yet
yaxim yaxim	`= 0.8.6= 0.8.7= 0.8.8`	No fix yet

Description

An incorrect implementation of "XEP-0280: Message Carbons" in multiple XMPP clients allows a remote attacker to impersonate any user, including contacts, in the vulnerable application's display. This allows for various kinds of social engineering attacks. This CVE is for yaxim and Bruno (0.8.6 - 0.8.8; Android).

References

openwall.com/lists/oss-security/2017/02/09/29 · Exploit
securityfocus.com/bid/96170
ge0rg/yaxim commit 65a38dc · Patch
rt-solutions.de/en/2017/02/CVE-2017-5589_xmpp_carbons · Exploit
rt-solutions.de/wp-content/uploads/2017/02/CVE-2017-5589_xmpp_carbons.pdf · Exploit

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free