CVE-2011-2531 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2011-2531): Prosody 0.8.x before 0.8.1, when MySQL is used, assigns an incorrect data type to the value column in certain tables, which might allow remote attackers to cause a denial of service (data truncation) by sending a large amount of data.
The ebuild for this is in the tree, we could just stabilize it.
CVE-2011-2532 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2011-2532): The json.decode function in util/json.lua in Prosody 0.8.x before 0.8.1 might allow remote attackers to cause a denial of service (infinite loop) via invalid JSON data, as demonstrated by truncated data. CVE-2011-2205 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2011-2205): Prosody before 0.8.1 does not properly detect recursion during entity expansion, which allows remote attackers to cause a denial of service (memory and CPU consumption) via a crafted XML document containing a large number of nested entity references, a similar issue to CVE-2003-1564.
(In reply to comment #1) > The ebuild for this is in the tree, we could just stabilize it. Thank you; no stabilization is required. Closing noglsa for ~arch only package.
