Description
Multiple buffer overflows in ircII 20020912 allows remote malicious IRC servers to cause a denial of service (crash) and possibly execute arbitrary code via responses that are not properly fed to the my_strcat function by (1) ctcp_buffer, (2) cannot_join_channel, (3) status_make_printable for Statusbar drawing, (4) create_server_list, and possibly other functions.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | epic4 | 1:1.1.11.20030409-1 | — |
| Debian 14 | ircii | 20030315-1 | — |
| Debian 13 | epic4 | 1:1.1.11.20030409-1 | — |
| Debian 13 | ircii | 20030315-1 | — |
| Debian 12 | epic4 | 1:1.1.11.20030409-1 | — |
| Debian 12 | ircii | 20030315-1 | — |
| Debian 3.0 | epic4 | 1.1.2.20020219-2.1 | DSA-298 |
| Debian 3.0 | ircii | 20020322-1.1 | DSA-291 |
Advisories 2
- DSA-291 ircii - buffer overflows Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-298 epic4 - buffer overflows Debian Security (DSA / DLA) · Mar 9, 2026
References
- DSA-298 vendor-advisory
- 7098 vdb-entry
- DSA-291 vendor-advisory
- 20030313 Buffer overflows in ircII-based clients mailing-list
- 20030319 [OpenPKG-SA-2003.024] OpenPKG Security Advisory (ircii) mailing-list