Debian: DSA-2453-1 Critical: Gajim Remote Code Execution Risk

Several vulnerabilities have been discovered in gajim, a feature-rich
jabber client. The Common Vulnerabilities and Exposures project
identifies the following problems:

CVE-2012-1987

gajim is not properly sanitizing input before passing it to shell
commands. An attacker can use this flaw to execute arbitrary code
on behalf of the victim if the user e.g. clicks on a specially crafted
URL in an instant message.

CVE-2012-2093

gajim is using predictable temporary files in an insecure manner when
converting instant messages containing LaTeX to images. A local
attacker can use this flaw to conduct symlink attacks and overwrite
files the victim has write access to.

CVE-2012-2086

gajim is not properly sanitizing input when logging conversations
which results in the possibility to conduct SQL injection attacks.


For the stable distribution (squeeze), this problem has been fixed in
version 0.13.4-3+squeeze2.

For the testing distribution (wheezy), this problem has been ...