{"id":"CVE-2016-9928","aliases":["DEBIAN-CVE-2016-9928","DLA-2260-1","DLA-724-1","EUVD-2016-10715","GHSA-q477-8j82-fjq4","MGASA-2016-0433","UBUNTU-CVE-2016-9928","USN-4506-1","openSUSE-SU-2024:10979-1","openSUSE-SU-2026:11142-1"],"status":"published","title":"MCabber before 1.0.4 is vulnerable to roster push attacks, which allows remote attackers to...","description":"MCabber before 1.0.4 is vulnerable to roster push attacks, which allows remote attackers to intercept communications, or add themselves as an entity on a 3rd party's roster as another user, which will also garner associated privileges, via crafted XMPP packets.","severity":{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-06","score":0.04512,"percentile":0.91563,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-269"],"published":"2016-11-27T00:00:00Z","modified":"2026-09-22T07:00:36Z","fixes":[{"ecosystem":"Debian:12","package":"mcabber","fixed_in":["0.10.2-1.1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"mcabber","fixed_in":["0.10.2-1.1"],"sources":["osv"]},{"ecosystem":"Debian:8","package":"mcabber","fixed_in":["0.10.2-1+deb8u1"],"sources":["osv"]},{"ecosystem":"Debian:7","package":"mcabber","fixed_in":["0.10.1-3+deb7u1"],"sources":["osv"]},{"ecosystem":"Mageia:5","package":"mcabber","fixed_in":["0.10.1-9.1.mga5"],"sources":["osv"]},{"ecosystem":"Ubuntu:16.04:LTS","package":"mcabber","fixed_in":["0.10.2-1+deb8u1build0.16.04.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"mcabber","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.10.2-1.1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"mcabber","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.10.2-1.1"}]}]},{"source":"osv","ecosystem":"Debian:8","package":"mcabber","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.10.2-1+deb8u1"}]}],"versions":["0.10.2-1"]},{"source":"osv","ecosystem":"Debian:7","package":"mcabber","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.10.1-3+deb7u1"}]}],"versions":["0.10.1-3"]},{"source":"osv","ecosystem":"Mageia:5","package":"mcabber","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.10.1-9.1.mga5"}]}]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"mcabber","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.10.2-1+deb8u1build0.16.04.1"}]}],"versions":["0.10.2-1","0.10.2-1build1"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"mcabber","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.10.2-1+deb8u1build0.16.04.1"}]}],"versions":["0.10.2-1","0.10.2-1build1"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"libqxmpp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.1-1.1"}]}],"bundled":2}],"products":[{"vendor":"canonical","product":"ubuntu_linux"},{"vendor":"debian","product":"debian_linux"},{"vendor":"mcabber","product":"mcabber"}],"references":[{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1403790","tags":["x_refsource_CONFIRM","x_transferred","Exploit","Issue Tracking","Third Party Advisory","report"]},{"url":"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=845258","tags":["x_refsource_CONFIRM","x_transferred","Exploit","Third Party Advisory","evidence","report"]},{"url":"https://bitbucket.org/McKael/mcabber-crew/commits/6e1ead98930d7dd0a520ad17c720ae4908429033/raw","tags":["x_refsource_CONFIRM","x_transferred","Patch","Third Party Advisory","fix","report"]},{"url":"https://gultsch.de/gajim_roster_push_and_message_interception.html","tags":["x_refsource_MISC","x_transferred","Third Party Advisory","advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2017/02/09/29","tags":["x_refsource_MISC","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2016/12/11/2","tags":["x_refsource_MISC","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"http://www.securityfocus.com/bid/94862","tags":["x_refsource_MISC","x_transferred","Third Party Advisory","VDB Entry","advisory"]},{"url":"http://lists.opensuse.org/opensuse-updates/2017-01/msg00130.html","tags":["x_refsource_CONFIRM","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"https://lists.debian.org/debian-lts-announce/2020/06/msg00031.html","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"https://usn.ubuntu.com/4506-1/","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred","Third Party Advisory","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-9928"},{"url":"https://github.com/advisories/GHSA-q477-8j82-fjq4"},{"url":"https://security-tracker.debian.org/tracker/CVE-2016-9928","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2016-0433.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=19858","tags":["report"]},{"url":"https://lwn.net/Alerts/707472/","tags":["web"]},{"url":"http://openwall.com/lists/oss-security/2016/12/11/2","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2016-9928","tags":["report"]},{"url":"http://www.openwall.com/lists/oss-security/2016/12/09/5","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-4506-1","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-9928","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2016-9928","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-5603","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2016-9928","description":"MCabber before 1.0.4 is vulnerable to roster push attacks, which allows remote attackers to intercept communications, or add themselves as an entity on a 3rd party's roster as another user, which will also garner associated privileges, via crafted XMPP packets.","status":"published","published":"2020-02-06T13:16:55Z","modified":"2024-08-06T03:07:31.382Z","updated_at":"2026-11-02T14:33:31.764001Z"}],"euvd":[{"id":"EUVD-2016-10715","description":"MCabber before 1.0.4 is vulnerable to roster push attacks, which allows remote attackers to intercept communications, or add themselves as an entity on a 3rd party's roster as another user, which will also garner associated privileges, via crafted XMPP packets.","status":"published","published":"2020-02-06T13:16:55Z","modified":"2024-08-06T03:07:31Z","updated_at":"2026-11-03T02:22:25.833438Z"}],"ghsa":[{"id":"GHSA-q477-8j82-fjq4","title":"MCabber before 1.0.4 is vulnerable to roster push attacks, which allows remote attackers to...","description":"MCabber before 1.0.4 is vulnerable to roster push attacks, which allows remote attackers to intercept communications, or add themselves as an entity on a 3rd party's roster as another user, which will also garner associated privileges, via crafted XMPP packets.","status":"published","published":"2022-05-24T17:08:07Z","modified":"2023-01-29T05:01:28Z","cwes":["CWE-269"],"updated_at":"2026-11-02T14:44:49.860954Z"}],"nvd":[{"id":"CVE-2016-9928","description":"MCabber before 1.0.4 is vulnerable to roster push attacks, which allows remote attackers to intercept communications, or add themselves as an entity on a 3rd party's roster as another user, which will also garner associated privileges, via crafted XMPP packets.","status":"published","published":"2020-02-06T14:15:10.957Z","modified":"2026-06-17T00:56:47.743Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"high","assessor":"primary"},{"version":"2.0","score":5.8,"vector":"AV:N/AC:M/Au:N/C:P/I:P/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-269"],"updated_at":"2026-11-02T14:03:40.524348Z"}],"osv":[{"id":"CVE-2016-9928","description":"MCabber before 1.0.4 is vulnerable to roster push attacks, which allows remote attackers to intercept communications, or add themselves as an entity on a 3rd party's roster as another user, which will also garner associated privileges, via crafted XMPP packets.","status":"published","published":"2020-02-06T14:15:10.957Z","modified":"2026-06-29T09:59:24.714294551Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:44:03.472693Z"},{"id":"DEBIAN-CVE-2016-9928","description":"MCabber before 1.0.4 is vulnerable to roster push attacks, which allows remote attackers to intercept communications, or add themselves as an entity on a 3rd party's roster as another user, which will also garner associated privileges, via crafted XMPP packets.","status":"published","published":"2020-02-06T14:15:10.957Z","modified":"2026-09-22T07:00:36.634651412Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:45:28.207321Z"},{"id":"UBUNTU-CVE-2016-9928","description":"MCabber before 1.0.4 is vulnerable to roster push attacks, which allows remote attackers to intercept communications, or add themselves as an entity on a 3rd party's roster as another user, which will also garner associated privileges, via crafted XMPP packets.","status":"published","published":"2020-02-06T14:15:00Z","modified":"2026-02-04T02:21:41.377319Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:54:13.356796Z"},{"id":"DLA-2260-1","title":"mcabber - security update","status":"published","published":"2020-06-28T00:00:00Z","modified":"2026-03-09T01:22:28.816862Z","updated_at":"2026-11-02T15:46:10.227108Z"},{"id":"DLA-724-1","title":"mcabber - security update","status":"published","published":"2016-11-27T00:00:00Z","modified":"2026-03-09T02:10:34.745556Z","updated_at":"2026-11-02T15:46:13.207219Z"},{"id":"MGASA-2016-0433","title":"Updated mcabber packages fix security vulnerability","description":"It was discovered that there was a \"roster push attack\" vulnerability in\nmcabber, a console-based Jabber (XMPP) client. A remote attacker can\nmodify the roster and intercept messages via a crafted roster-push IQ\nstanza (CVE-2016-9928).\n","status":"published","published":"2016-12-30T22:22:42Z","modified":"2026-04-16T06:24:11.848501866Z","updated_at":"2026-11-02T15:49:40.103088Z"},{"id":"openSUSE-SU-2024:10979-1","title":"libqxmpp-devel-1.4.0-1.2 on GA media","description":"These are all security issues fixed in the libqxmpp-devel-1.4.0-1.2 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T02:46:18.525632Z","updated_at":"2026-11-02T16:58:34.894275Z"},{"id":"openSUSE-SU-2026:11142-1","title":"libQXmppQt6-10-1.16.1-1.1 on GA media","description":"These are all security issues fixed in the libQXmppQt6-10-1.16.1-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-06-28T00:00:00Z","modified":"2026-06-29T09:45:08.418289889Z","updated_at":"2026-11-02T16:58:38.95195Z"},{"id":"USN-4506-1","title":"mcabber vulnerability","description":"It was discovered that MCabber does not properly manage roster pushes. An\nattacker could possibly use this issue to remotely perform \nmachine-in-the-middle attacks. (CVE-2016-9928).\n","status":"published","published":"2020-09-16T16:10:08Z","modified":"2026-02-10T04:41:55Z","updated_at":"2026-11-02T16:58:14.547547Z"}]}}