src/common/latex.py in Gajim 0.15 allows local users to overwrite arbitrary files via a symlink attack on a temporary latex file, related to the get_tmpfile_name function.

The remote host is affected by the vulnerability described in GLSA-201208-04 (Gajim: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Gajim. Please review       the CVE identifiers referenced below for details.
  Impact :

    A remote attacker could entice a user to open a specially crafted link       using Gajim, possibly resulting in execution of arbitrary code with the       privileges of the process or a Denial of Service condition. Furthermore,       a remote attacker could use a specially crafted Jabber ID, possibly       resulting in execution of arbitrary SQL statements.
    A local attacker could perform symlink attacks to overwrite arbitrary       files with the privileges of the user running the application.
  Workaround :

    There is no known workaround at this time.

Fixes CVE-2012-2093 gajim (LaTeX module): Insecure creation of temporary file

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Several vulnerabilities have been discovered in Gajim, a feature-rich Jabber client. The Common Vulnerabilities and Exposures project identifies the following problems :

  - CVE-2012-1987     Gajim is not properly sanitizing input before passing it     to shell commands. An attacker can use this flaw to     execute arbitrary code on behalf of the victim if the     user e.g. clicks on a specially crafted URL in an     instant message.

  - CVE-2012-2093     Gajim is using predictable temporary files in an     insecure manner when converting instant messages     containing LaTeX to images. A local attacker can use     this flaw to conduct symlink attacks and overwrite files     the victim has write access to.

  - CVE-2012-2086     Gajim is not properly sanitizing input when logging     conversations which results in the possibility to     conduct SQL injection attacks.

ID	Name	Product	Family	Severity
61543	GLSA-201208-04 : Gajim: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
58912	Fedora 16 : gajim-0.15-2.fc16 (2012-6061)	Nessus	Fedora Local Security Checks	low
58910	Fedora 15 : gajim-0.15-2.fc15 (2012-6001)	Nessus	Fedora Local Security Checks	low
58887	Fedora 17 : gajim-0.15-2.fc17 (2012-6161)	Nessus	Fedora Local Security Checks	low
58766	Debian DSA-2453-1 : gajim - several vulnerabilities	Nessus	Debian Local Security Checks	high

Detections

Analytics

CVE-2012-2093

medium

Tenable Plugins

high

low

low

low

high