Ubuntu 11.10 Security Notice USN-1250-1: Critical Empathy XSS Exploit

ubuntu

October 28, 2011

Empathy could be made to run programs or display webpages via speciallycrafted nicknames.

Summary

Empathy could be made to run programs or display webpages via specially

crafted nicknames.

Software Description:

- empathy: GNOME multi-protocol chat and call client

Details:

It was discovered that a cross-site scripting (XSS) vulnerability in

the Adium theme allows remote attackers to inject arbitrary javascript

or HTML via a crafted nickname in XMPP group conversations.

Topics Covered

security advisory XSS Ubuntu remote execution empathy

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 11.10:
  empathy                         3.2.0.1-0ubuntu1.1

Ubuntu 11.04:
  empathy                         2.34.0-0ubuntu3.2

Ubuntu 10.10:
  empathy                         2.32.1-0ubuntu1.2

Ubuntu 10.04 LTS:
  empathy                         2.30.3-0ubuntu1.1

After a standard system update you need to restart your session to
make all the necessary changes.