CVE-2016-9107

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

The OTR plugin for Gajim sends information in cleartext when using XHTML, which allows remote attackers to obtain sensitive information via unspecified vectors.

Metrics

CVSS 3.0 7.5/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-200

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://www.openwall.com/lists/oss-security/2016/10/30/11Mailing List, Third Party Advisory
http://www.openwall.com/lists/oss-security/2016/10/30/2Mailing List, Third Party Advisory
http://www.securityfocus.com/bid/94099Third Party Advisory, VDB Entry
https://dev.gajim.org/gajim/gajim-plugins/issues/145Issue Tracking, Patch
https://trac-plugins.gajim.org/changeset/c7c2e519ed63377bc943dd01c4661b0fe49321aePermissions Required
http://www.openwall.com/lists/oss-security/2016/10/30/11Mailing List, Third Party Advisory
http://www.openwall.com/lists/oss-security/2016/10/30/2Mailing List, Third Party Advisory
http://www.securityfocus.com/bid/94099Third Party Advisory, VDB Entry
https://dev.gajim.org/gajim/gajim-plugins/issues/145Issue Tracking, Patch
https://trac-plugins.gajim.org/changeset/c7c2e519ed63377bc943dd01c4661b0fe49321aePermissions Required

Timeline

Published: Jan 13, 2017
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2016

CVE-2016-91087.5Integer overflow in the js_regcomp function in regexp.c in Artifex Software, Inc. MuJS before commit b6de34ac6d8bb7dd5461c57940acfbd3ee7fd93 CVE-2016-91097.5Artifex Software MuJS allows attackers to cause a denial of service (crash) via vectors related to incomplete escape sequences. NOTE: this CVE-2016-91116.8Incorrect access control mechanisms in Citrix Receiver Desktop Lock 4.5 allow an attacker to bypass the authentication requirement by levera CVE-2016-91127.5Floating Point Exception (aka FPE or divide by zero) in opj_pi_next_cprl function in openjp2/pi.c:523 in OpenJPEG 2.1.2.CVE-2016-91137.5There is a NULL pointer dereference in function imagetobmp of convertbmp.c:980 of OpenJPEG 2.1.2. image->comps[0].data is not assigned a val CVE-2016-91147.5There is a NULL Pointer Access in function imagetopnm of convert.c:1943(jp2) of OpenJPEG 2.1.2. image->comps[compno].data is not assigned a CVE-2016-91156.5Heap Buffer Over-read in function imagetotga of convert.c(jp2):942 in OpenJPEG 2.1.2. Impact is Denial of Service. Someone must open a craft CVE-2016-91166.5NULL Pointer Access in function imagetopnm of convert.c:2226(jp2) in OpenJPEG 2.1.2. Impact is Denial of Service. Someone must open a crafte CVE-2016-91176.5NULL Pointer Access in function imagetopnm of convert.c(jp2):1289 in OpenJPEG 2.1.2. Impact is Denial of Service. Someone must open a crafte CVE-2016-91185.3Heap Buffer Overflow (WRITE of size 4) in function pnmtoimage of convert.c:1719 in OpenJPEG 2.1.2.CVE-2016-91196.1Cross-site scripting (XSS) vulnerability in the link dialogue in GUI editor in MoinMoin before 1.9.8 allows remote attackers to inject arbit CVE-2016-91207.8Race condition in the ion_ioctl function in drivers/staging/android/ion/ion.c in the Linux kernel before 4.6 allows local users to gain priv