Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [day] [month] [year] [list]
Date: Mon, 04 Mar 2013 12:37:22 +0000
From: Will Thompson <>
To: Telepathy <>,
Subject: CVE-2013-1769: remotely-triggered NULL pointer dereference in telepathy-gabble


I've just released two new versions of telepathy-gabble which fix a 
family of remotely-triggered NULL pointer dereference bugs in 
telepathy-gabble: specifically, in its implementation of the hashing 
algorithm specified in <>. These 
bugs existed in essentially all previous versions of telepathy-gabble. A 
malicious user can trigger the bug for any of their contacts who use 
Gabble by publishing caps which trigger the bug, or for anyone whose JID 
they know.

In the current stable release series, the bug is fixed in 
telepathy-gabble 0.16.5 (release announcement: 

In the current unstable release series, the bug is fixed in 
telepathy-gabble 0.17.3 (release announcement: 

Simon McVittie has prepared some patches which apply to the 0.12 series 
of telepathy-gabble. Interested parties can find them, and more 
information, on the bug report: 
<>. That said, I 
recommend that distributors of 0.12 upgrade to the 0.16 stable series if 

Thanks to Kurt Seifried of the Red Hat Security Response Team for 
allocating a CVE ID for this issue.


Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.