Description
Dino before 2019-09-10 does not properly check the source of a carbons message in module/xep/0280_message_carbons.vala.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | dino-im | 0.0.git20190911.2a70a4e-1 | — |
| Debian 13 | dino-im | 0.0.git20190911.2a70a4e-1 | — |
| Debian 12 | dino-im | 0.0.git20190911.2a70a4e-1 | — |
| Debian 10 | dino-im | 0.0.git20181129-1+deb10u1 | DSA-4524-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 18.04 LTS | dino-im | 0.0.git20180130-1ubuntu0.1 | USN-4306-1 |
Advisories 2
- DSA-4524-1 dino-im - security update Debian Security (DSA / DLA) · Mar 9, 2026
- USN-4306-1 dino-im vulnerabilities Ubuntu Security Notices (USN) · Feb 10, 2026
References
- https://github.com/dino/dino/commit/e84f2c49567e86d2a261ea264d65c4adc549c930
- https://gultsch.de/dino_multiple.html
- [oss-security] 20190912 3 CVEs in dino mailing-list
- 20190917 [SECURITY] [DSA 4524-1] dino-im security update mailing-list
- DSA-4524 vendor-advisory
- FEDORA-2019-2555c77f63 vendor-advisory
- FEDORA-2019-3d3bb765ca vendor-advisory
- FEDORA-2019-0eb6d51f81 vendor-advisory
- USN-4306-1 vendor-advisory