Description
Multiple buffer overflows in BitchX IRC client 1.0-0c19 and earlier allow remote malicious IRC servers to cause a denial of service (crash) and possibly execute arbitrary code via long hostnames, nicknames, or channel names, which are not properly handled by the functions (1) send_ctcp, (2) cannot_join_channel, (3) cluster, (4) BX_compress_modes, (5) handle_oper_vision, and (6) ban_it.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 3.0 | ircii-pana | 1.0-0c19-1.1 | DSA-306 |
Advisories 1
- DSA-306 ircii-pana - buffer overflows, integer overflow Debian Security (DSA / DLA) · Mar 9, 2026
References
- 7096 vdb-entry
- http://security.debian.org/pool/updates/main/i/ircii-pana/ircii-pana_1.0-0c16-2.1.diff.gz
- 7097 vdb-entry
- CLA-2003:655 vendor-advisory
- 20030324 GLSA: bitchx (200303-21) mailing-list
- DSA-306 vendor-advisory
- 20030313 Buffer overflows in ircII-based clients mailing-list
- 7100 vdb-entry
- 7099 vdb-entry