CVE catalog

CVE-2017-18226

jabberd2: CVE-2017-18226

[CVE catalog]

Severity
Medium
Published
Source
[NVD] · [CVE record]
EPSS
0.25% · Oct 25, 2026

The Gentoo net-im/jabberd2 package through 2.6.1 sets the ownership of /var/run/jabber to the jabber account, which might allow local users to kill arbitrary processes by leveraging access to this account for PID file modification before a root script executes a "kill -TERM `cat /var/run/jabber/filename.pid`" command.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianjabberd2sid2.7.0-10vulnerable
Debianjabberd2forky2.7.0-10vulnerable
Debianjabberd2trixie2.7.0-8vulnerable
Debianjabberd2bookworm2.7.0-4vulnerable

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianjabberd2sourcesid(unfixed)lowNot reported[902783]
Debianjabberd2sourceforky(unfixed)lowNot reported[902783]
Debianjabberd2sourcetrixie(unfixed)lowNot reported[902783]
Debianjabberd2sourcebookworm(unfixed)lowNot reported[902783]

[Debian bug #902783]

Notes

[trixie] jabberd2: Minor issue, default init system not affected [bookworm] jabberd2: Minor issue, default init system not affected

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [jabberd2]Affected

    Source package: [jabberd2]

    Details (2)

    • 2.7.0-4+b2 · amd64 · bookworm

      Affected

      dsa · jabberd2 · debian · bookworm; dsa · jabberd2 · debian · 12

    • 2.7.0-4+b2 · arm64 · bookworm

      Affected

      dsa · jabberd2 · debian · bookworm; dsa · jabberd2 · debian · 12

[Debian 13 (Trixie)]

  • [jabberd2]Affected
    Details (2)

    • 2.7.0-8 · amd64 · trixie

      Affected

      dsa · jabberd2 · debian · 13

    • 2.7.0-8 · arm64 · trixie

      Affected

      dsa · jabberd2 · debian · 13

Observed:

References

[Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database]