CVE-2015-2058

NameCVE-2015-2058
Descriptionc2s/c2s.c in Jabber Open Source Server 2.3.2 and earlier truncates data without ensuring it remains valid UTF-8, which allows remote authenticated users to read system memory or possibly have other unspecified impact via a crafted JID.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, Mageia, GitHub code/issues, web search, more)
Debian Bugs779154

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
jabberd2 (PTS)stretch (security), stretch2.4.0-3+deb9u1fixed
buster2.7.0-1fixed
bookworm, sid, bullseye2.7.0-2fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
jabberd2source(unstable)2.3.3-1779154

Notes

https://github.com/jabberd2/jabberd2/issues/85
https://www.openwall.com/lists/oss-security/2015/02/09/13

Search for package or bug name: Reporting problems