CVE-2017-5589

An incorrect implementation of "XEP-0280: Message Carbons" in multiple XMPP clients allows a remote attacker to impersonate any user, including contacts, in the vulnerable application's display. This allows for various kinds of social engineering attacks. This CVE is for yaxim and Bruno (0.8.6 - 0.8.8; Android).

References

Affected packages

Git / github.com/ge0rg/yaxim

Affected ranges

Type

GIT

Repo

https://github.com/ge0rg/yaxim

Events

Introduced

be5abb31041c3da8bd96f3c60af254bb0a6029d5

Last affected

7e91fd11dc7f831e50ce4511fb9419c5b48ee8c1

Fixed

65a38dc77545d9568732189e86089390f0ceaf9f

Database specific

{
    "cpe": [
        "cpe:2.3:a:yaxim:bruno:0.8.6:*:*:*:*:android:*:*",
        "cpe:2.3:a:yaxim:yaxim:0.8.6:*:*:*:*:android:*:*",
        "cpe:2.3:a:yaxim:bruno:0.8.7:*:*:*:*:android:*:*",
        "cpe:2.3:a:yaxim:yaxim:0.8.7:*:*:*:*:android:*:*",
        "cpe:2.3:a:yaxim:bruno:0.8.8:*:*:*:*:android:*:*",
        "cpe:2.3:a:yaxim:yaxim:0.8.8:*:*:*:*:android:*:*"
    ],
    "source": [
        "CPE_STRING",
        "REFERENCES"
    ],
    "extracted_events": [
        {
            "introduced": "0.8.6"
        },
        {
            "last_affected": "0.8.6"
        },
        {
            "introduced": "0.8.7"
        },
        {
            "last_affected": "0.8.7"
        },
        {
            "introduced": "0.8.8"
        },
        {
            "last_affected": "0.8.8"
        }
    ]
}

Affected versions

0.*

0.8.6

0.8.7

0.8.8

Database specific

vanir_signatures

[
    {
        "digest": {
            "length": 3926.0,
            "function_hash": "172370957006944829851377657957829823161"
        },
        "signature_version": "v1",
        "deprecated": false,
        "signature_type": "Function",
        "target": {
            "function": "processPacket",
            "file": "src/org/yaxim/androidclient/service/SmackableImp.java"
        },
        "id": "CVE-2017-5589-2ee27eff",
        "source": "https://github.com/ge0rg/yaxim/commit/65a38dc77545d9568732189e86089390f0ceaf9f"
    },
    {
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "153737100144617991198265298819933771344",
                "14142142644532598557007988398869176820",
                "191608210482791009829108665398745144520",
                "149708554919926206651512033937721213057"
            ]
        },
        "signature_version": "v1",
        "source": "https://github.com/ge0rg/yaxim/commit/65a38dc77545d9568732189e86089390f0ceaf9f",
        "signature_type": "Line",
        "target": {
            "file": "src/org/yaxim/androidclient/service/SmackableImp.java"
        },
        "id": "CVE-2017-5589-b4dd117c",
        "deprecated": false
    },
    {
        "digest": {
            "length": 4734.0,
            "function_hash": "281192577220386992273384113389427695740"
        },
        "signature_version": "v1",
        "source": "https://github.com/ge0rg/yaxim/commit/65a38dc77545d9568732189e86089390f0ceaf9f",
        "signature_type": "Function",
        "target": {
            "function": "registerMessageListener",
            "file": "src/org/yaxim/androidclient/service/SmackableImp.java"
        },
        "id": "CVE-2017-5589-b7ef297a",
        "deprecated": false
    }
]

vanir_signatures_modified

"2026-07-08T10:55:28Z"

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2017-5589.json"