{"id":"CVE-2023-28686","aliases":["ALPINE-CVE-2023-28686","DEBIAN-CVE-2023-28686","DSA-5379-1","EUVD-2023-32329","GHSA-xxch-mf4j-qcvj","MGASA-2023-0122","UBUNTU-CVE-2023-28686","USN-7430-1","openSUSE-SU-2024:12813-1"],"status":"published","title":"Dino before 0.2.3, 0.3.x before 0.3.2, and 0.4.x before 0.4.2 allows attackers to modify the...","description":"Dino before 0.2.3, 0.3.x before 0.3.2, and 0.4.x before 0.4.2 allows attackers to modify the personal bookmark store via a crafted message. The attacker can change the display of group chats or force a victim to join a group chat; the victim may then be tricked into disclosing sensitive information.","severity":{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.00699,"percentile":0.53428,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-639"],"published":"2023-03-24T00:00:00Z","modified":"2026-11-03T06:32:48Z","fixes":[{"ecosystem":"Alpine:v3.16","package":"dino","fixed_in":["0.3.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.17","package":"dino","fixed_in":["0.3.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.18","package":"dino","fixed_in":["0.4.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.19","package":"dino","fixed_in":["0.4.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"dino","fixed_in":["0.4.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"dino","fixed_in":["0.4.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"dino","fixed_in":["0.4.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"dino","fixed_in":["0.4.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"dino","fixed_in":["0.4.2-r0"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"dino-im","fixed_in":["0.4.2-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"dino-im","fixed_in":["0.4.2-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"dino-im","fixed_in":["0.4.2-1"],"sources":["osv"]},{"ecosystem":"Debian:11","package":"dino-im","fixed_in":["0.2.0-3+deb11u1"],"sources":["osv"]},{"ecosystem":"Mageia:8","package":"dino","fixed_in":["0.2.3-1.mga8"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:20.04:LTS","package":"dino-im","fixed_in":["0.1.0-1ubuntu0.1~esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:22.04:LTS","package":"dino-im","fixed_in":["0.3.0-3ubuntu0.1~esm1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"dino","fixed_in":["0.4.2-1.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.16","package":"dino","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.3.0"},{"fixed":"0.3.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.17","package":"dino","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.3.0"},{"fixed":"0.3.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.18","package":"dino","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.3.0"},{"fixed":"0.4.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.19","package":"dino","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.3.0"},{"fixed":"0.4.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"dino","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.3.0"},{"fixed":"0.4.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"dino","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.3.0"},{"fixed":"0.4.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"dino","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.3.0"},{"fixed":"0.4.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"dino","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.3.0"},{"fixed":"0.4.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"dino","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.3.0"},{"fixed":"0.4.2-r0"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"dino-im","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.4.2-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"dino-im","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.4.2-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"dino-im","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.4.2-1"}]}]},{"source":"osv","ecosystem":"Debian:11","package":"dino-im","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.2.0-3+deb11u1"}]}],"versions":["0.2.0-3"]},{"source":"osv","ecosystem":"Mageia:8","package":"dino","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.2.3-1.mga8"}]}]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"dino-im","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.1.0-1ubuntu0.1~esm1"}]}],"versions":["0.0.git20190916.f746ce7-1","0.0.git20191002.7adb0e8-1","0.0.git20191028.388cc56-1","0.0.git20191119.f9c69a2-1","0.0.git20191119.f9c69a2-2","0.0.git20191219.9565140-1","0.0.git20200109.3fc9bda-1","0.1.0-1","0.1.0-1build1","0.1.0-1build2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"dino-im","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.3.0-3ubuntu0.1~esm1"}]}],"versions":["0.2.0-3","0.2.1+git20210824.93e2e0d-1","0.3.0-2","0.3.0-3"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"dino-im","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.1.0-1ubuntu0.1~esm1"}]}],"versions":["0.0.git20190916.f746ce7-1","0.0.git20191002.7adb0e8-1","0.0.git20191028.388cc56-1","0.0.git20191119.f9c69a2-1","0.0.git20191119.f9c69a2-2","0.0.git20191219.9565140-1","0.0.git20200109.3fc9bda-1","0.1.0-1","0.1.0-1build1","0.1.0-1build2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"dino-im","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.3.0-3ubuntu0.1~esm1"}]}],"versions":["0.2.0-3","0.2.1+git20210824.93e2e0d-1","0.3.0-2","0.3.0-3"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"dino","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.4.2-1.1"}]}]}],"products":[{"vendor":"debian","product":"debian_linux"},{"vendor":"dino","product":"dino"},{"vendor":"fedoraproject","product":"fedora"}],"references":[{"url":"https://dino.im/security/cve-2023-28686/","tags":["x_transferred","Patch","Vendor Advisory","web","report"]},{"url":"https://www.debian.org/security/2023/dsa-5379","tags":["vendor-advisory","x_transferred","Third Party Advisory","advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IIWXAK656EHSRIRUHLPBE3AX2I4TMH7M/","tags":["vendor-advisory","x_transferred","advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BQLCEUZS5GPHUQMS7C6W2NS3PHYUFHYF/","tags":["vendor-advisory","x_transferred","advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GOH6NYTLPM52MDIR2IRVUR3REDVWZV6N/","tags":["vendor-advisory","x_transferred","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-28686","tags":["advisory"]},{"url":"https://dino.im/security/cve-2023-28686"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BQLCEUZS5GPHUQMS7C6W2NS3PHYUFHYF"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GOH6NYTLPM52MDIR2IRVUR3REDVWZV6N"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IIWXAK656EHSRIRUHLPBE3AX2I4TMH7M"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BQLCEUZS5GPHUQMS7C6W2NS3PHYUFHYF"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GOH6NYTLPM52MDIR2IRVUR3REDVWZV6N"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IIWXAK656EHSRIRUHLPBE3AX2I4TMH7M"},{"url":"https://github.com/advisories/GHSA-xxch-mf4j-qcvj"},{"url":"https://security.alpinelinux.org/vuln/CVE-2023-28686","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/28xxx/CVE-2023-28686.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2023-28686","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2023-0122.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=31726","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2023-28686","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-28686","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-7430-1","tags":["advisory"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2023-28686","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2023-28686","description":"Dino before 0.2.3, 0.3.x before 0.3.2, and 0.4.x before 0.4.2 allows attackers to modify the personal bookmark store via a crafted message. The attacker can change the display of group chats or force a victim to join a group chat; the victim may then be tricked into disclosing sensitive information.","status":"published","published":"2023-03-24T00:00:00Z","modified":"2025-02-19T21:41:47.635Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium","assessor":"adp"}],"cwes":["CWE-639"],"updated_at":"2026-11-02T14:35:32.752775Z"}],"euvd":[{"id":"EUVD-2023-32329","description":"Dino before 0.2.3, 0.3.x before 0.3.2, and 0.4.x before 0.4.2 allows attackers to modify the personal bookmark store via a crafted message. The attacker can change the display of group chats or force a victim to join a group chat; the victim may then be tricked into disclosing sensitive information.","status":"published","published":"2023-03-24T00:00:00Z","modified":"2025-02-19T21:41:47Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T20:53:26.353093Z"}],"ghsa":[{"id":"GHSA-xxch-mf4j-qcvj","title":"Dino before 0.2.3, 0.3.x before 0.3.2, and 0.4.x before 0.4.2 allows attackers to modify the...","description":"Dino before 0.2.3, 0.3.x before 0.3.2, and 0.4.x before 0.4.2 allows attackers to modify the personal bookmark store via a crafted message. The attacker can change the display of group chats or force a victim to join a group chat; the victim may then be tricked into disclosing sensitive information.","status":"published","published":"2023-03-24T06:30:16Z","modified":"2025-02-20T00:33:07Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N","level":"high"}],"cwes":["CWE-639"],"updated_at":"2026-11-02T14:59:59.716099Z"}],"nvd":[{"id":"CVE-2023-28686","description":"Dino before 0.2.3, 0.3.x before 0.3.2, and 0.4.x before 0.4.2 allows attackers to modify the personal bookmark store via a crafted message. The attacker can change the display of group chats or force a victim to join a group chat; the victim may then be tricked into disclosing sensitive information.","status":"published","published":"2023-03-24T04:15:55.963Z","modified":"2026-06-17T05:48:33.623Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N","level":"high","assessor":"primary"},{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-639"],"updated_at":"2026-11-02T14:07:50.908252Z"}],"osv":[{"id":"ALPINE-CVE-2023-28686","description":"Dino before 0.2.3, 0.3.x before 0.3.2, and 0.4.x before 0.4.2 allows attackers to modify the personal bookmark store via a crafted message. The attacker can change the display of group chats or force a victim to join a group chat; the victim may then be tricked into disclosing sensitive information.","status":"published","published":"2023-03-24T04:15:55.963Z","modified":"2026-11-03T06:32:48.433393071Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N","level":"high"}],"updated_at":"2026-11-03T07:16:46.202932Z"},{"id":"CVE-2023-28686","description":"Dino before 0.2.3, 0.3.x before 0.3.2, and 0.4.x before 0.4.2 allows attackers to modify the personal bookmark store via a crafted message. The attacker can change the display of group chats or force a victim to join a group chat; the victim may then be tricked into disclosing sensitive information.","status":"published","published":"2023-03-24T00:00:00Z","modified":"2026-10-28T02:30:54.031085427Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:44:31.468318Z"},{"id":"DEBIAN-CVE-2023-28686","description":"Dino before 0.2.3, 0.3.x before 0.3.2, and 0.4.x before 0.4.2 allows attackers to modify the personal bookmark store via a crafted message. The attacker can change the display of group chats or force a victim to join a group chat; the victim may then be tricked into disclosing sensitive information.","status":"published","published":"2023-03-24T04:15:55.963Z","modified":"2026-10-26T18:01:40.352591543Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N","level":"high"}],"updated_at":"2026-11-02T15:45:39.679062Z"},{"id":"UBUNTU-CVE-2023-28686","description":"Dino before 0.2.3, 0.3.x before 0.3.2, and 0.4.x before 0.4.2 allows attackers to modify the personal bookmark store via a crafted message. The attacker can change the display of group chats or force a victim to join a group chat; the victim may then be tricked into disclosing sensitive information.","status":"published","published":"2023-03-24T04:15:00Z","modified":"2026-02-04T03:46:16.791855Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"},{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N","level":"high"}],"updated_at":"2026-11-02T16:54:20.997471Z"},{"id":"DSA-5379-1","title":"dino-im - security update","status":"published","published":"2023-03-27T00:00:00Z","modified":"2026-03-09T02:10:10.168421Z","updated_at":"2026-11-02T15:46:17.543497Z"},{"id":"MGASA-2023-0122","title":"Updated dino packages fix security vulnerability","description":"When a Dino client receives a specifically crafted message from an\nunauthorized sender, it would use information from that message to add,\nupdate or remove entries in the user’s personal bookmark store without\nrequiring further user interaction. (CVE-2023-28686)\n","status":"published","published":"2023-03-31T00:13:46Z","modified":"2026-04-16T04:43:27.236804147Z","updated_at":"2026-11-02T15:49:42.263076Z"},{"id":"openSUSE-SU-2024:12813-1","title":"dino-0.4.2-1.1 on GA media","description":"These are all security issues fixed in the dino-0.4.2-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T04:20:23.641567Z","updated_at":"2026-11-02T16:58:35.751245Z"},{"id":"USN-7430-1","title":"dino-im vulnerability","description":"Kim Alvefur discovered that Dino did not correctly sanitize certain\nmessages. A remote attacker could possibly use this issue to leak\nsensitive information.\n","status":"published","published":"2025-04-09T23:46:20Z","modified":"2026-04-27T17:53:18.937985Z","updated_at":"2026-11-02T16:58:19.988474Z"}]}}