CVE-2017-18225

NameCVE-2017-18225
DescriptionThe Gentoo net-im/jabberd2 package through 2.6.1 installs jabberd, jabberd2-c2s, jabberd2-router, jabberd2-s2s, and jabberd2-sm in /usr/bin owned by the jabber account, which might allow local users to gain privileges by leveraging access to this account and then waiting for root to execute one of these programs.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, Mageia, GitHub code/issues, web search, more)

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
jabberd2 (PTS)stretch (security), stretch2.4.0-3+deb9u1fixed
buster2.7.0-1fixed
bookworm, sid, bullseye2.7.0-2fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
jabberd2source(unstable)(not affected)

Notes

- jabberd2 <not-affected> (Installed with correct permissions in Debian)
https://bugs.gentoo.org/629412

Search for package or bug name: Reporting problems