Cross-site scripting (XSS) vulnerability in the theme_adium_append_message function in empathy-theme-adium.c in the Adium theme in libempathy-gtk in Empathy 3.2.1 and earlier allows remote attackers to inject arbitrary web script or HTML via a crafted alias (aka nickname).

Insufficient quoting of nick names allowed attackers to inject arbitrary html (CVE-2011-3635)

The following bug has been fixed :

  - Insufficient quoting of nick names allowed attackers to     inject arbitrary html (CVE-2011-3635)

It was discovered that a cross-site scripting (XSS) vulnerability in the Adium theme allows remote attackers to inject arbitrary JavaScript or HTML via a crafted nickname in XMPP group conversations.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
75823	openSUSE Security Update : empathy (openSUSE-SU-2011:1257-1)	Nessus	SuSE Local Security Checks	medium
75475	openSUSE Security Update : empathy (openSUSE-SU-2011:1257-1)	Nessus	SuSE Local Security Checks	medium
57098	SuSE 11.1 Security Update : empathy (SAT Patch Number 5363)	Nessus	SuSE Local Security Checks	medium
56680	Ubuntu 10.04 LTS / 10.10 / 11.04 / 11.10 : empathy vulnerabilities (USN-1250-1)	Nessus	Ubuntu Local Security Checks	medium

Detections

Analytics

CVE-2011-3635

medium

Tenable Plugins

medium

medium

medium

medium