UBUNTU-CVE-2016-0756

See a problem?
Please try reporting it to the source first.

Source

https://ubuntu.com/security/CVE-2016-0756

Import Source

https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2016/UBUNTU-CVE-2016-0756.json

JSON Data

https://api.osv.dev/v1/vulns/UBUNTU-CVE-2016-0756

Related

CVE-2016-0756

Published

2016-01-29T20:59:00Z

Modified

2025-01-13T10:21:12Z

Severity

5.3 (Medium) CVSS_V3 - CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N CVSS Calculator

Summary

[none]

Details

The generatedialback function in the moddialback module in Prosody before 0.9.10 does not properly separate fields when generating dialback keys, which allows remote attackers to spoof XMPP network domains via a crafted stream id and domain name that is included in the target domain as a suffix.

References

Affected packages

Ubuntu:16.04:LTS / prosody

Package

Name: prosody
Purl: pkg:deb/ubuntu/prosody@0.9.10-1?arch=source&distro=xenial

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

0.9.10-1

Affected versions

0.*

0.9.8-1

0.9.9-1

Ecosystem specific

{
    "binaries": [
        {
            "binary_name": "prosody",
            "binary_version": "0.9.10-1"
        },
        {
            "binary_name": "prosody-dbgsym",
            "binary_version": "0.9.10-1"
        }
    ],
    "availability": "No subscription required",
    "ubuntu_priority": "medium"
}