Debian Dino-Im vulnerabilities

CVE-2023-28686 [HIGH] CVE-2023-28686: dino-im - Dino before 0.2.3, 0.3.x before 0.3.2, and 0.4.x before 0.4.2 allows attackers t... Dino before 0.2.3, 0.3.x before 0.3.2, and 0.4.x before 0.4.2 allows attackers to modify the personal bookmark store via a crafted message. The attacker can change the display of group chats or force a victim to join a group chat; the victim may then be tricked into disclosing sensitive information. Scope: local bookworm: resolved (fixed in 0.4.2-1) bullseye: resolv

CVE-2021-33896 [MEDIUM] CVE-2021-33896: dino-im - Dino before 0.1.2 and 0.2.x before 0.2.1 allows Directory Traversal (only for cr... Dino before 0.1.2 and 0.2.x before 0.2.1 allows Directory Traversal (only for creation of new files) via URI-encoded path separators. Scope: local bookworm: resolved (fixed in 0.2.0-3) bullseye: resolved (fixed in 0.2.0-3) forky: resolved (fixed in 0.2.0-3) sid: resolved (fixed in 0.2.0-3) trixie: resolved (fixed in 0.2.0-3)

CVE-2019-16236 [HIGH] CVE-2019-16236: dino-im - Dino before 2019-09-10 does not check roster push authorization in module/roster... Dino before 2019-09-10 does not check roster push authorization in module/roster/module.vala. Scope: local bookworm: resolved (fixed in 0.0.git20190911.2a70a4e-1) bullseye: resolved (fixed in 0.0.git20190911.2a70a4e-1) forky: resolved (fixed in 0.0.git20190911.2a70a4e-1) sid: resolved (fixed in 0.0.git20190911.2a70a4e-1) trixie: resolved (fixed in 0.0.git20190911.2a

CVE-2019-16237 [HIGH] CVE-2019-16237: dino-im - Dino before 2019-09-10 does not properly check the source of an MAM message in m... Dino before 2019-09-10 does not properly check the source of an MAM message in module/xep/0313_message_archive_management.vala. Scope: local bookworm: resolved (fixed in 0.0.git20190911.2a70a4e-1) bullseye: resolved (fixed in 0.0.git20190911.2a70a4e-1) forky: resolved (fixed in 0.0.git20190911.2a70a4e-1) sid: resolved (fixed in 0.0.git20190911.2a70a4e-1) trixie: res

CVE-2019-16235 [HIGH] CVE-2019-16235: dino-im - Dino before 2019-09-10 does not properly check the source of a carbons message i... Dino before 2019-09-10 does not properly check the source of a carbons message in module/xep/0280_message_carbons.vala. Scope: local bookworm: resolved (fixed in 0.0.git20190911.2a70a4e-1) bullseye: resolved (fixed in 0.0.git20190911.2a70a4e-1) forky: resolved (fixed in 0.0.git20190911.2a70a4e-1) sid: resolved (fixed in 0.0.git20190911.2a70a4e-1) trixie: resolved (f