Description
Multiple unspecified vulnerabilities in ZNC 0.092 allow remote attackers to cause a denial of service (exception and daemon crash) via unknown vectors related to "unsafe substr() calls."
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | znc | 0.092-2 | — |
| Debian 13 | znc | 0.092-2 | — |
| Debian 12 | znc | 0.092-2 | — |
References
- ADV-2010-2071 vdb-entry
- 40919 third-party-advisory
- http://znc.svn.sourceforge.net/viewvc/znc?view=revision&revision=2095
- FEDORA-2010-12481 vendor-advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=622600
- 42314 vdb-entry
- [oss-security] 20100810 Re: Re: CVE Request - ZNC mailing-list
- [oss-security] 20100809 CVE Request - ZNC mailing-list
- [oss-security] 20100809 Re: CVE Request - ZNC mailing-list
- FEDORA-2010-12468 vendor-advisory
- 40970 third-party-advisory