CVE-2011-1000: Input Validation
First published: Fri Feb 18 2011(Updated: )
jingle-factory.c in Telepathy Gabble 0.11 before 0.11.7, 0.10 before 0.10.5, and 0.8 before 0.8.15 allows remote attackers to sniff audio and video calls via a crafted google:jingleinfo stanza that specifies an alternate server for streamed media.
Credit: secalert@redhat.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Red Hat Telepathy Gabble | =0.11.4 | |
| Red Hat Telepathy Gabble | =0.11.5 | |
| Red Hat Telepathy Gabble | =0.11.2 | |
| Red Hat Telepathy Gabble | =0.11.3 | |
| Red Hat Telepathy Gabble | =0.11.6 | |
| Red Hat Telepathy Gabble | =0.11 | |
| Red Hat Telepathy Gabble | =0.11.1 | |
| Red Hat Telepathy Gabble | =0.10.1 | |
| Red Hat Telepathy Gabble | =0.10.3 | |
| Red Hat Telepathy Gabble | =0.10 | |
| Red Hat Telepathy Gabble | =0.10.2 | |
| Red Hat Telepathy Gabble | =0.10.4 | |
| Red Hat Telepathy Gabble | =0.8.14 | |
| Red Hat Telepathy Gabble | =0.8.11 | |
| Red Hat Telepathy Gabble | =0.8.10 | |
| Red Hat Telepathy Gabble | =0.8.12 | |
| Red Hat Telepathy Gabble | =0.8.5 | |
| Red Hat Telepathy Gabble | =0.8.6 | |
| Red Hat Telepathy Gabble | =0.8.3 | |
| Red Hat Telepathy Gabble | =0.8.4 | |
| Red Hat Telepathy Gabble | =0.8.9 | |
| Red Hat Telepathy Gabble | =0.8.2 | |
| Red Hat Telepathy Gabble | =0.8.1 | |
| Red Hat Telepathy Gabble | =0.8.8 | |
| Red Hat Telepathy Gabble | =0.8 | |
| Red Hat Telepathy Gabble | =0.8.7 | |
| Red Hat Telepathy Gabble | =0.8.13 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://secunia.com/advisories/43404
- http://secunia.com/advisories/43369
- http://www.debian.org/security/2011/dsa-2169
- http://www.vupen.com/english/advisories/2011/0412
- http://www.openwall.com/lists/oss-security/2011/02/17/7
- https://bugs.freedesktop.org/show_bug.cgi?id=34048
- http://www.openwall.com/lists/oss-security/2011/02/17/4
- http://secunia.com/advisories/43316
- http://www.ubuntu.com/usn/USN-1067-1
- http://www.vupen.com/english/advisories/2011/0428
- http://www.securityfocus.com/bid/46440
- http://lists.fedoraproject.org/pipermail/package-announce/2011-February/054324.html
- http://secunia.com/advisories/43485
- http://www.vupen.com/english/advisories/2011/0572
- http://lists.fedoraproject.org/pipermail/package-announce/2011-March/054575.html
- http://secunia.com/advisories/43545
- http://www.vupen.com/english/advisories/2011/0537
- http://lists.fedoraproject.org/pipermail/package-announce/2011-March/054409.html
- http://secunia.com/advisories/44023
- http://www.vupen.com/english/advisories/2011/0901
- https://hermes.opensuse.org/messages/7848248
- https://exchange.xforce.ibmcloud.com/vulnerabilities/65523
Frequently Asked Questions
What is the severity of CVE-2011-1000?
CVE-2011-1000 has a medium severity level as it allows remote attackers to potentially sniff audio and video calls.
How do I fix CVE-2011-1000?
To mitigate CVE-2011-1000, update Telepathy Gabble to version 0.11.7 or later, 0.10.5 or later, or 0.8.15 or later.
Which versions of Telepathy Gabble are affected by CVE-2011-1000?
CVE-2011-1000 affects Telepathy Gabble versions 0.11.4 to 0.11.6, 0.10 before 0.10.5, and 0.8 before 0.8.15.
What type of vulnerability is CVE-2011-1000?
CVE-2011-1000 is a remote code execution vulnerability that can be exploited via crafted google:jingleinfo stanzas.
Can CVE-2011-1000 be exploited without user interaction?
Yes, CVE-2011-1000 can be exploited remotely without requiring user interaction.
- agent/references
- agent/type
- collector/mitre-cve
- source/MITRE
- agent/weakness
- agent/severity
- agent/remedy
- agent/last-modified-date
- agent/author
- agent/description
- agent/event
- agent/first-publish-date
- agent/source
- agent/softwarecombine
- agent/tags
- collector/nvd-historical
- agent/software-canonical-lookup-request
- collector/nvd-index
- vendor/freedesktop
- canonical/red hat telepathy gabble
- version/red hat telepathy gabble/0.11.4
- version/red hat telepathy gabble/0.11.5
- version/red hat telepathy gabble/0.11.2
- version/red hat telepathy gabble/0.11.3
- version/red hat telepathy gabble/0.11.6
- version/red hat telepathy gabble/0.11
- version/red hat telepathy gabble/0.11.1
- version/red hat telepathy gabble/0.10.1
- version/red hat telepathy gabble/0.10.3
- version/red hat telepathy gabble/0.10
- version/red hat telepathy gabble/0.10.2
- version/red hat telepathy gabble/0.10.4
- version/red hat telepathy gabble/0.8.14
- version/red hat telepathy gabble/0.8.11
- version/red hat telepathy gabble/0.8.10
- version/red hat telepathy gabble/0.8.12
- version/red hat telepathy gabble/0.8.5
- version/red hat telepathy gabble/0.8.6
- version/red hat telepathy gabble/0.8.3
- version/red hat telepathy gabble/0.8.4
- version/red hat telepathy gabble/0.8.9
- version/red hat telepathy gabble/0.8.2
- version/red hat telepathy gabble/0.8.1
- version/red hat telepathy gabble/0.8.8
- version/red hat telepathy gabble/0.8
- version/red hat telepathy gabble/0.8.7
- version/red hat telepathy gabble/0.8.13