Security readout for executives and security teams
Plain-English summary
CVE-2011-4170 is a cross-site scripting issue in Empathy’s Adium chat theme handling. A remote contact could use a crafted nickname in a /me action so the vulnerable client renders attacker-controlled HTML or script. The source bundle does not provide CVSS, a patch version, or evidence of active exploitation.
Executive priority
Handle as a targeted legacy-client risk, not an internet-scale emergency. The main urgency is finding and retiring old Empathy deployments that may still process untrusted chat messages.
Technical view
The flaw is in theme_adium_append_message in empathy-theme-adium.c within libempathy-gtk. Empathy 3.2.1 and earlier are described as affected. The injection vector is a crafted alias, also called nickname, in a /me event. It is explicitly distinct from CVE-2011-3635.
Likely exposure
Exposure appears limited to environments still running Empathy 3.2.1 or earlier with the Adium theme code path. Modern fleets are less likely to be exposed, but legacy Linux desktop images, long-lived appliances, or archived workstation builds should be checked.
Exploitation context
The CVE describes remote injection through chat content metadata, not local access. KEV is false in the provided bundle, and no cited source confirms exploitation in the wild. Treat exploit status as unconfirmed.
Researcher notes
The public bundle gives a clear affected function and vector but lacks CVSS, CWE mapping, patch details, and exploit confirmation. Avoid assuming broader GNOME, Adium, or messaging-platform exposure beyond Empathy 3.2.1 and earlier as described.
Mitigation direction
- Inventory Empathy installations and identify versions 3.2.1 or earlier.
- Check GNOME or distribution vendor guidance for the fixed package or advisory.
- Retire or replace obsolete Empathy clients where business use no longer exists.
- Reduce use of vulnerable legacy chat clients until vendor guidance is confirmed.
- Prioritize remediation on systems used for sensitive communications.
Validation and detection
- Confirm whether Empathy is installed on managed Linux desktop images.
- Record installed Empathy and libempathy-gtk package versions.
- Check whether the Adium theme functionality is present or enabled.
- Review vendor package changelogs against CVE-2011-4170.
- Document any remaining legacy exception and compensating controls.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2011-4170 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS and timeline data
No CVSS vectors or timeline events were available in the normalized CVE source material.
Source materials
- CVE List V5 sourceCVE List V5
- https://bugzilla.gnome.org/show_bug.cgi?id=662035CVE reference · x_refsource_MISC
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.