A code injection flaw was found in the way execute command helper method of Gajim, a Jabber client written in PyGTK, performed sanitization of the 'command' parameter. A remote attacker could provide a specially-crafted link, that when visited by Gajim user would lead to gajim executable crash or, potentially, arbitrary code execution with the privileges of the user running the executable.
While this issue has been previously corrected in the versions of the gajim package, as shipped with Fedora release of 15, 16, 17, and as shipped with Fedora EPEL 6, it still affects the version of the gajim package, as shipped with Fedora EPEL 5. Please schedule an update.
Created gajim tracking bugs for this issue
Affects: epel-5 [bug 833485]
gajim-0.12.5-1.el5.2 has been pushed to the Fedora EPEL 5 stable repository. If problems still persist, please make note of it in this bug report.