CVE-2017-18225

EUVD-2017-9357
The Gentoo net-im/jabberd2 package through 2.6.1 installs jabberd, jabberd2-c2s, jabberd2-router, jabberd2-s2s, and jabberd2-sm in /usr/bin owned by the jabber account, which might allow local users to gain privileges by leveraging access to this account and then waiting for root to execute one of these programs.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
7.8 HIGH
LOCAL
LOW
LOW
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: 28%
Affected Products (NVD)
VendorProductVersion
jabberd2jabberd2
𝑥
≤ 2.6.1
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
jabberd2
bookworm
2.7.0-4
fixed
bullseye
2.7.0-2
fixed
sid
2.7.0-7
fixed
trixie
2.7.0-7
fixed
Common Weakness Enumeration
References
https://bugs.gentoo.org/629412
https://bugs.gentoo.org/629412