PT-2017-18101 · Weechat+1 · Weechat+1

Published 2017-04-23 · Updated 2024-06-15 · CVE-2017-8073

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions WeeChat versions prior to 1.7.1

Description The issue allows a remote crash by sending a filename via DCC to the IRC plugin. This occurs in the irc ctcp dcc filename without quotes function during quote removal, with a buffer overflow.

Recommendations For versions prior to 1.7.1, update to version 1.7.1 or later to resolve the issue. As a temporary workaround, consider disabling the DCC feature in the IRC plugin until a patch is available.

Fix

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

ALT-PU-2017-1923

CVE-2017-8073

DLA-919-1

DSA-3836-1

MGASA-2017-0190

OPENSUSE-SU-2024:11508-1

Affected Products

Alt Linux

Weechat

References · 32

• https://github.com/weechat/weechat/commit/2fb346f25f79e412cf0ed314fdf791763c19b70b · Patch
• https://cve.org/CVERecord?id=CVE-2017-8073 · Security Note
• https://security-tracker.debian.org/tracker/DSA-3836-1 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:11508-1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2017-8073 · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2017-0190 · Vendor Advisory
• https://weechat.org/news/95/20170422-Version-1.7.1 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2017-8073 · Vendor Advisory
• https://errata.altlinux.org/ALT-PU-2017-1923 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2017-0190.html · Security Note
• https://security-tracker.debian.org/tracker/CVE-2017-8073 · Vendor Advisory
• https://osv.dev/vulnerability/ALPINE-CVE-2017-8073 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2017-8073 · Vendor Advisory
• https://ubuntu.com/security/CVE-2017-8073 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ER23GT23US5JXDLUZAMGMWXKZ74MI4S2 · Vendor Advisory