Launchpad.net

CVE 2015-8688

Gajim before 0.16.5 allows remote attackers to modify the roster and intercept messages via a crafted roster-push IQ stanza.

See the CVE page on Mitre.org for more details.