jabber.el supports viewing and publishing avatars according to XEP-0153, vCard-Based Avatars. By default, if you have an avatar in your vCard (see Personal information), it will be published for others to see, and if other people publish their avatars, they will be displayed in the roster buffer and in the header line of chat buffers, assuming that your Emacs can display images.
To disable retrieval of other people's avatars, set
jabber-vcard-avatars-retrieve to nil. To disable publishing of
your own avatar, set jabber-vcard-avatars-publish to nil.
Avatars are cached in the directory specified by
jabber-avatar-cache-directory, by default
~/.jabber-avatars/. The cache is never cleaned, so you might
want to do that yourself from time to time.