Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
7.5
CVE-2019-16236: Dino IM allows unauthorized roster changes
CVE-2019-16236 · published 7 years ago
Summary
The Dino instant messaging client for Debian does not verify who is allowed to modify contact lists. This could let an attacker add, remove, or alter contacts without permission. Update Dino to a version released after September 10, 2019 to fix the issue.
What to do
- Update debian dino-im to version 0.0.git20190911.2a70a4e-1.
- Update dino dino to version 0.1.0 or later.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Debian:12 | debian | dino-im |
< 0.0.git20190911.2a70a4e-1 Fix: upgrade to 0.0.git20190911.2a70a4e-1
|
| Debian:13 | debian | dino-im |
< 0.0.git20190911.2a70a4e-1 Fix: upgrade to 0.0.git20190911.2a70a4e-1
|
| Debian:14 | debian | dino-im |
< 0.0.git20190911.2a70a4e-1 Fix: upgrade to 0.0.git20190911.2a70a4e-1
|
| – | dino | dino |
< 0.1.0 cpe:2.3:a:dino:dino:*:*:*:*:*:*:*:* |
| – | canonical | ubuntu_linux |
18.04 cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:* |
| – | fedoraproject | fedora |
29 30 31 cpe:2.3:o:fedoraproject:fedora:29:*:*:*:*:*:*:* |
| – | debian | debian_linux |
10.0 cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* |
Original advisory text
Dino before 2019-09-10 does not check roster push authorization in module/roster/module.vala.
Dino before 2019-09-10 does not check roster push authorization in module/roster/module.vala.
References
- https://security-tracker.debian.org/tracker/CVE-2019-16236 Vendor Advisory
- http://www.openwall.com/lists/oss-security/2019/09/12/5 Mailing List Third Party Advisory
- https://github.com/dino/dino/commit/dd33f5f949248d87d34f399e8846d5ee5b8823d9 Patch Third Party Advisory
- https://gultsch.de/dino_multiple.html Exploit Third Party Advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro...
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro...
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro...
- https://seclists.org/bugtraq/2019/Sep/31 Issue Tracking Mailing List Third Party Advisory
- https://usn.ubuntu.com/4306-1/ Third Party Advisory
- https://www.debian.org/security/2019/dsa-4524 Third Party Advisory
Severity
7.5
High
Type
CWE-862Missing Authorization
Timeline
Published11 Sep 2019
Updated29 Oct 2026
First seen21 Sep 2026
Track software like this
Free during beta