{"id":"CVE-2008-6393","aliases":["DEBIAN-CVE-2008-6393","DSA-1741-1","EUVD-2008-6363","GHSA-4p4v-f795-xc4p"],"status":"published","title":"PSI Jabber client before 0.12.1 allows remote attackers to cause a denial of service (crash) and...","description":"PSI Jabber client before 0.12.1 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a file transfer request with a negative value in a SOCKS5 option, which bypasses a signed integer check and triggers an integer overflow and a heap-based buffer overflow.","severity":{"version":"2.0","score":10,"vector":"AV:N/AC:L/Au:N/C:C/I:C/A:C","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.18344,"percentile":0.97247,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":true},"cwes":["CWE-189"],"published":"2009-03-03T16:00:00Z","modified":"2026-10-23T17:47:40Z","exploits":[{"source":"exploitdb","id":"EDB-7555","title":"Psi Jabber Client (Windows / Linux) - Remote Denial of Service","type":"dos","platform":"multiple","date":"2008-12-23","verified":true,"url":"https://www.exploit-db.com/exploits/7555"}],"fixes":[{"ecosystem":"Debian:12","package":"psi","fixed_in":["0.12.1-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"psi","fixed_in":["0.12.1-1"],"sources":["osv"]},{"ecosystem":"Debian:5.0","package":"psi","fixed_in":["0.11-9"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"psi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.12.1-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"psi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.12.1-1"}]}]},{"source":"osv","ecosystem":"Debian:5.0","package":"psi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.11-9"}]}],"versions":["0.11-8"]}],"products":[{"vendor":"psi-im","product":"psi"}],"references":[{"url":"http://secunia.com/advisories/34259","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","advisory"]},{"url":"http://bugs.gentoo.org/show_bug.cgi?id=252830","tags":["x_refsource_CONFIRM","x_transferred","Exploit","evidence"]},{"url":"http://secunia.com/advisories/34301","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","advisory"]},{"url":"https://www.exploit-db.com/exploits/7555","tags":["exploit","x_refsource_EXPLOIT-DB","x_transferred","web"]},{"url":"http://www.securityfocus.com/archive/1/499563","tags":["mailing-list","x_refsource_BUGTRAQ","x_transferred","Exploit","evidence"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2009-03/msg00001.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","web"]},{"url":"https://www.redhat.com/archives/fedora-package-announce/2009-March/msg00071.html","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"http://www.openwall.com/lists/oss-security/2009/02/25/5","tags":["mailing-list","x_refsource_MLIST","x_transferred","Exploit","evidence"]},{"url":"http://jolmos.blogspot.com/2008/12/psi-remote-integer-overflow.html","tags":["x_refsource_MISC","x_transferred","article"]},{"url":"http://sourceforge.net/project/shownotes.php?release_id=658912","tags":["x_refsource_CONFIRM","x_transferred","Patch","fix"]},{"url":"http://secunia.com/advisories/33311","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","Vendor Advisory","advisory"]},{"url":"https://www.redhat.com/archives/fedora-package-announce/2009-March/msg00080.html","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"http://www.debian.org/security/2009/dsa-1741","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","advisory"]},{"url":"http://secunia.com/advisories/34119","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2008-6393"},{"url":"https://github.com/advisories/GHSA-4p4v-f795-xc4p"},{"url":"https://security-tracker.debian.org/tracker/CVE-2008-6393","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2008-6393","description":"PSI Jabber client before 0.12.1 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a file transfer request with a negative value in a SOCKS5 option, which bypasses a signed integer check and triggers an integer overflow and a heap-based buffer overflow.","status":"published","published":"2009-03-03T16:00:00Z","modified":"2024-08-07T11:27:35.77Z","updated_at":"2026-11-02T14:34:46.265542Z"}],"euvd":[{"id":"EUVD-2008-6363","description":"PSI Jabber client before 0.12.1 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a file transfer request with a negative value in a SOCKS5 option, which bypasses a signed integer check and triggers an integer overflow and a heap-based buffer overflow.","status":"published","published":"2009-03-03T16:00:00Z","modified":"2024-08-07T11:27:35Z","updated_at":"2026-11-03T01:38:36.321295Z"}],"ghsa":[{"id":"GHSA-4p4v-f795-xc4p","title":"PSI Jabber client before 0.12.1 allows remote attackers to cause a denial of service (crash) and...","description":"PSI Jabber client before 0.12.1 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a file transfer request with a negative value in a SOCKS5 option, which bypasses a signed integer check and triggers an integer overflow and a heap-based buffer overflow.","status":"published","published":"2022-05-17T00:39:55Z","modified":"2023-02-03T05:02:11Z","updated_at":"2026-11-02T14:53:07.269726Z"}],"nvd":[{"id":"CVE-2008-6393","description":"PSI Jabber client before 0.12.1 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a file transfer request with a negative value in a SOCKS5 option, which bypasses a signed integer check and triggers an integer overflow and a heap-based buffer overflow.","status":"published","published":"2009-03-03T16:30:00.217Z","modified":"2026-06-16T23:02:08.95Z","cvss":[{"version":"2.0","score":10,"vector":"AV:N/AC:L/Au:N/C:C/I:C/A:C","level":"high","assessor":"primary"}],"cwes":["CWE-189"],"updated_at":"2026-11-02T14:01:31.451035Z"}],"osv":[{"id":"CVE-2008-6393","description":"PSI Jabber client before 0.12.1 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a file transfer request with a negative value in a SOCKS5 option, which bypasses a signed integer check and triggers an integer overflow and a heap-based buffer overflow.","status":"published","published":"2009-03-03T16:30:00Z","modified":"2026-04-10T03:40:28.716223Z","updated_at":"2026-11-02T15:43:57.452479Z"},{"id":"DEBIAN-CVE-2008-6393","description":"PSI Jabber client before 0.12.1 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a file transfer request with a negative value in a SOCKS5 option, which bypasses a signed integer check and triggers an integer overflow and a heap-based buffer overflow.","status":"published","published":"2009-03-03T16:30:00.217Z","modified":"2026-10-23T17:47:40.038858008Z","updated_at":"2026-11-02T15:45:23.742363Z"},{"id":"DSA-1741-1","title":"psi - denial of service","status":"published","published":"2009-03-14T00:00:00Z","modified":"2026-03-09T01:19:40.672322Z","updated_at":"2026-11-02T15:46:14.734124Z"}]}}