Description
PSI Jabber client before 0.12.1 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a file transfer request with a negative value in a SOCKS5 option, which bypasses a signed integer check and triggers an integer overflow and a heap-based buffer overflow.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 13 | psi | 0.12.1-1 | — |
| Debian 12 | psi | 0.12.1-1 | — |
| Debian 5.0 | psi | 0.11-9 | DSA-1741-1 |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Exploit-DB 1
- Psi Jabber Client (Windows / Linux) - Remote Denial of Service EDB-7555 · dos · Dec 23, 2008 · verified
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Advisories 1
- DSA-1741-1 psi - denial of service Debian Security (DSA / DLA) · Mar 9, 2026
References
- 34259 third-party-advisory
- http://bugs.gentoo.org/show_bug.cgi?id=252830
- 34301 third-party-advisory
- 7555 exploit
- 20081223 [ISecAuditors Security Advisories] PSI remote integer overflow DoS mailing-list
- SUSE-SR:2009:006 vendor-advisory
- FEDORA-2009-2285 vendor-advisory
- [oss-security] 20090225 CVE request: Psi <0.12.1 DoS mailing-list
- http://jolmos.blogspot.com/2008/12/psi-remote-integer-overflow.html
- http://sourceforge.net/project/shownotes.php?release_id=658912
- 33311 third-party-advisory
- FEDORA-2009-2295 vendor-advisory
- DSA-1741 vendor-advisory
- 34119 third-party-advisory