CVE-2016-9928: MCabber before 1.0.4 is vulnerable to roster push attacks, which allows remote attackers to intercept communications, or add themselves as an entity on a 3rd…

PriorityP346high7.4CVSS 3.1

AVNACHPRNUINSUCHIHAN

EPSS

4.51%

90.5th percentile

MCabber before 1.0.4 is vulnerable to roster push attacks, which allows remote attackers to intercept communications, or add themselves as an entity on a 3rd party's roster as another user, which will also garner associated privileges, via crafted XMPP packets.

Affected

10 ranges

Vendor	Product	Version range	Fixed in
canonical	ubuntu_linux	—	—
debian	debian_linux	—	—
debian	mcabber	< mcabber 0.10.2-1.1 (bookworm)	mcabber 0.10.2-1.1 (bookworm)
mcabber	mcabber	—	—
mcabber	mcabber	>= 0 < 0.10.2-1.1	0.10.2-1.1
mcabber	mcabber	>= 0 < 0.10.2-1.1	0.10.2-1.1
mcabber	mcabber	>= 0 < 0.10.2-1.1	0.10.2-1.1
mcabber	mcabber	>= 0 < 0.10.2-1.1	0.10.2-1.1
mcabber	mcabber	>= 0 < 0.10.2-1+deb8u1build0.16.04.1	0.10.2-1+deb8u1build0.16.04.1
mcabber	mcabber	>= 1.0.0 < 1.0.4	1.0.4

CVSS provenance

nvdv3.17.4HIGHCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

nvdv2.05.8MEDIUMAV:N/AC:M/Au:N/C:P/I:P/A:N

osv7.4HIGH

vendor_debian7.4HIGH

vendor_ubuntu7.4HIGH

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.