A cross-site scripting (XSS) flaw was found in the Adium theme for Empathy, an instant messaging client for GNOME, due to incorrect sanitization of the user nickname / alias, when new user joined a room. A remote attacker, valid Empathy user with specially-crafted nickname could send a message to particular IRC room, leading to arbitrary HTML or webscript execution, when the nickname was displayed by the theme. Upstream bug report: [1] https://bugzilla.gnome.org/show_bug.cgi?id=662035 Relevant upstream patch: [2] http://git.gnome.org/browse/empathy/commit/?id=739aca418457de752be13721218aaebc74bd9d36
This issue affects the versions of the empathy package, as shipped with Fedora release of 14 and 15.
Created empathy tracking bugs for this issue Affects: fedora-all [bug 747737]