CVE-2011-1000 Information disclosure in n/a
Remote attackers can sniff audio and video calls by sending a crafted stanza that redirects media streams to an alternate server.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2011-1000?
CVE-2011-1000 is a medium-severity vulnerability in n/a, published on 18 Feb 2011. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
jingle-factory.c in Telepathy Gabble 0.11 before 0.11.7, 0.10 before 0.10.5, and 0.8 before 0.8.15 allows remote attackers to sniff audio and video calls via a crafted google:jingleinfo stanza that specifies an alternate server for streamed media.
Weakness: CWE-20
Which versions are affected by CVE-2011-1000?
It affects 1 product.
Products include Freedesktop Telepathy Gabble.
How do I fix CVE-2011-1000?
Upgrade to a fixed version.
Is CVE-2011-1000 being exploited?
There is no known exploitation of CVE-2011-1000 in the wild and no public exploit code.
Sources
Also known as DSA-2169-1, GHSA-vjf4-chxp-cg8g.