[Bug 879301] Re: HTML injection in nicknames

Fri Oct 28 17:06:41 UTC 2011

This bug was fixed in the package empathy - 3.2.0.1-0ubuntu1.1

---------------
empathy (3.2.0.1-0ubuntu1.1) oneiric-security; urgency=low

  * SECURITY UPDATE: remote HTML injection (LP: #879301)
    - debian/patches/50_empathy-CVE-2011-3635-lp879301.patch: escape
      HTML in when displaying other users' names. (Thanks to upstream
      for patch.)
    - CVE-2011-3635, CVE-2011-4170
 -- Steve Beattie <sbeattie at ubuntu.com>   Mon, 24 Oct 2011 14:56:42 -0700

** Changed in: empathy (Ubuntu)
       Status: In Progress => Fix Released

** CVE added: http://www.cve.mitre.org/cgi-
bin/cvename.cgi?name=2011-4170

-- 
You received this bug notification because you are a member of
Telepathy, which is subscribed to empathy in Ubuntu.
https://bugs.launchpad.net/bugs/879301

Title:
  HTML injection in nicknames

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/empathy/+bug/879301/+subscriptions