{"id":"CVE-2017-5603","details":"An incorrect implementation of \"XEP-0280: Message Carbons\" in multiple XMPP clients allows a remote attacker to impersonate any user, including contacts, in the vulnerable application's display. This allows for various kinds of social engineering attacks. This CVE is for Jitsi 2.5.5061 - 2.9.5544.","modified":"2026-07-08T16:53:24.868113Z","published":"2017-02-09T20:59:00.420Z","related":["openSUSE-SU-2024:10979-1","openSUSE-SU-2026:11142-1"],"database_specific":{"unresolved_ranges":[{"cpes":["cpe:2.3:a:jitsi:jitsi:2.5.5061:*:*:*:*:*:*:*","cpe:2.3:a:jitsi:jitsi:2.9.5544:*:*:*:*:*:*:*"],"extracted_events":[{"introduced":"2.5.5061"},{"last_affected":"2.5.5061"},{"introduced":"2.9.5544"},{"last_affected":"2.9.5544"}],"source":"CPE_STRING","vendor_product":"jitsi:jitsi"}]},"references":[{"type":"WEB","url":"http://www.securityfocus.com/bid/96174"},{"type":"FIX","url":"https://github.com/jitsi/jitsi/commit/7d66da61b316c9480b63000f831b6de723b87315"},{"type":"EVIDENCE","url":"http://openwall.com/lists/oss-security/2017/02/09/29"},{"type":"EVIDENCE","url":"https://rt-solutions.de/en/2017/02/CVE-2017-5589_xmpp_carbons/"},{"type":"EVIDENCE","url":"https://rt-solutions.de/wp-content/uploads/2017/02/CVE-2017-5589_xmpp_carbons.pdf"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/jitsi/jitsi","events":[{"introduced":"0"},{"fixed":"7d66da61b316c9480b63000f831b6de723b87315"}],"database_specific":{"source":"REFERENCES"}}],"versions":["5544","5543","5542","5541","5540","5539","5538","5537","5536","5535","5534","5533","5532","5531","5530","5529","5528","5527","5526","5525","5524","5523","5522","5521","5520","5519","5518","5517","5516","5515","5514","5513","5512","5511","5510","5509","5508","5507","5506","5505","5504","5503","5502","5501","5500","5499","5498","5497","5496","5495","5494","5493","5492","5491","5490","5489","5488","5487","5486","5485","5484","5483","5482","5481","5480","5479","5478","5477","5476","5475","5474","5473","5472","5471","5470","5469","5468","5467","5466","5465","5464","5463","5462","5461","5460","5459","5458","5457","5456","5455","5454","5453","5452","5451","5450","5449","5448","5447","5446","5445","5444","5443","5442","5441","Jitsi-2.8","5426","5440","5439","5438","5437","5436","5435","5434","5433","5432","5431","5430","5429","5428","5427","5425","5424","5423","5422","5421","5420","5419","5418","5417","5416","5415","5401","5414","5413","5412","5411","5410","5409","5408","5407","5406","5405","5404","5403","5402","5400","5399","5398","5397","5396","5395","5394","5393","5392","5391","Jitsi-2.6","5390","5389","5388","5387","5386","5385","5384","5383","5382","5381","5380","5379","5378","5377","5376","5375","5374","5373","5372","5371","5370","5369","5368","5367","5366","5365","5364","5363","5362","5361","5360","5359","5358","5357","5356","5355","5354","5353","5352","5351","5350","5349","5348","5347","5346","5345","5344","5343","5342","5341","5340","5339","5338","5337","5336","5335","5334","5333","5332","5331","5330","5329","5328","5327","5326","5325","5324","5323","5322","5321","5320","5319","5318","5317","5316","5315","5314","5313","5312","5311","5310","5309","5308","5307","5306","5305","5304","5303","5302","5301","5300","5299","5298","5297","5296","5295","5294","5293","5292","5291","5290","5289","5288","5287","5286","5285","5275","5274","5273","5271","5272","5270","5269","5268","5267","5266","5265","5264","5263","5262","5261","5260","5259","5258","5257","5256","5255","5254","5253","5252","5251","5250","5249","5248","5247","5246","5245","5244","5243","5240","5239","5238","5237","5236","5235","5234","5233","5231","5230","5229","5228","5227","5226","5225","5224","5223","5222","5221","5220","5219","5218","5217","5216","5215","5214","5213","5212","5211","5210","5209","5208","5207","5206","5205","5204","5203","5202","5201","5200","5199","5198","5197","5196","5195","5194","5193","5192","5191","5190","5189","5188","5187","5186","5185","5184","5183","5182","5181","5180","5179","5178","5177","5176","5175","5174","5173","5172","5171","5170","5169","5168","5167","5166","5165","5164","5163","5162","5161","5160","5159","5158","5157","5156","5155","5154","5153","5152","5151","5150","5149","5148","5147","5146","5145","5144","5143","5142","5141","5140","5139","5138","5137","5136","5135","5134","5133","5132","5131","5130","5129","5128","5127","5126","5125","5124","5123","5122","5121","5120","5119","5118","5117","5116","5115","5112","5114","5113","5111","5110","5109","5108","5107","5106","5105","5104","5103","5102","5101","5100","5099","5098","5097","5096","5095","5094","5093","5092","5091","5090","5089","5088","5087","5086","5085","5084","5083","5082","5081","5080","5079","5078","5077","5076","5075","5074","5073","5072","5071","5070","5069","5068","5067","5066","5065","5064","5063","5062","5061","5060","5059","5058","5057","5056","5055","5054","5053","5052","5051","5050","5049","5048","5047","5046","5045","5044","5043","5042","5041","5040","5039","5038","5037","5036","5035","5034","5033","5032","5031","5030","5029","5028","5027","5026","5025","5024","5023","5022","5021","5020","5019","5018","5017","5016","5015","5014","5013","5012","5011","5010","5009","5008","5007","5006","5005","5004","5003","5002","5001","5000","4999","4998","Jitsi-2.4","4997","4996","4995","4994","4993","4992","4991","4990","4989","4988","4987","4986","4985","4984","4983","4982","4981","4980","4979","4978","4977","4976","4975","4974","4973","4972","4971","4970","4969","4968","4967","4966","4965","4964","4963","4962","4961","4960","4959","4958","4957","4956","4955","4954","4953","4952","4951","4950","4949","4948","4947","4946","4945","4944","4943","4942","4941","4940","4939","4938","4937","4936","4935","4934","4933","4932","4931","4930","4929","4928","4927","4926","4925","4924","4923","4922","4921","4920","4919","4918","4917","4916","4915","4914","4913","4912","4911","4910","4909","4908","4907","4906","4905","4904","4903","4902","4901","4900","4899","4898","4897","4896","4895","4894","4893","4892","4891","4882","4890","4889","4888","4887","4886","4885","4884","4883","4881","4880","4879","4878","4877","4876","4875","4874","4873","4872","4871","4870","4869","4868","4867","4866","4865","4864","4863","4862","4861","4860","4859","4858","4857","4856","4855","4854","4853","4852","4851","4850","4849","4848","4847","4846","4845","4844","4843","4842","4841","4840","4839","4838","4837","4836","4835","4834","4833","4832","4831","4830","4829","4828","4827","4826","4825","4824","4823","4822","4821","4820","4819","4818","4817","4816","4815","4814","4813","4812","4811","4810","4809","4808","4807","4806","4805","4804","4803","4802","4801","4800","4799","4798","4797","4796","4795","4794","4793","4792","4791","4790","4789","4788","4787","4786","4784","4783","4782","4781","4780","4779","4778","4777","4776","4775","4774","4773","4772","4771","4770","4769","4768","4767","4766","4765","4764","4763","4762","4761","4760","4759","4758","4757","4756","4755","4754","4753","4752","4751","4750","4749","4742","4740","4736","4735","4734","4733","4731","4721","4718","4717","4714","Jitsi-2.2","Jitsi-2.0"],"database_specific":{"vanir_signatures":[{"target":{"file":"src/net/java/sip/communicator/impl/protocol/jabber/OperationSetBasicInstantMessagingJabberImpl.java"},"deprecated":false,"digest":{"line_hashes":["107578669910084079894611907846344324764","143909334712409636331827581362332141657","12902339851635929102351687526928292194","324089159069590738857614046580844865286"],"threshold":0.9},"id":"CVE-2017-5603-34cc6793","signature_type":"Line","signature_version":"v1","source":"https://github.com/jitsi/jitsi/commit/7d66da61b316c9480b63000f831b6de723b87315"},{"target":{"file":"src/net/java/sip/communicator/impl/protocol/jabber/OperationSetBasicInstantMessagingJabberImpl.java","function":"processPacket"},"deprecated":false,"digest":{"function_hash":"273513514354543505449521079392273462612","length":3643},"id":"CVE-2017-5603-c259804c","signature_type":"Function","signature_version":"v1","source":"https://github.com/jitsi/jitsi/commit/7d66da61b316c9480b63000f831b6de723b87315"}],"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2017-5603.json","vanir_signatures_modified":"2026-07-08T16:53:24Z"}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N"}]}