Description
Heap-based buffer overflow in WeeChat 0.3.6 through 0.3.9 allows remote attackers to cause a denial of service (crash or hang) and possibly execute arbitrary code via crafted IRC colors that are not properly decoded.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | weechat | 0.3.9.1-1 | — |
| Debian 13 | weechat | 0.3.9.1-1 | — |
| Debian 12 | weechat | 0.3.9.1-1 | — |
References
- 87279 vdb-entry
- 56482 vdb-entry
- FEDORA-2012-17973 vendor-advisory
- 51377 third-party-advisory
- openSUSE-SU-2013:0150 vendor-advisory
- https://savannah.nongnu.org/bugs/?37704
- [oss-security] 20121112 Re: CVE Request -- WeeChat (prior to 0.3.9.1): Heap-based buffer overflow when decoding IRC colors in strings mailing-list
- https://wiki.mageia.org/en/Support/Advisories/MGASA-2012-0330
- openSUSE-SU-2012:1580 vendor-advisory
- FEDORA-2012-17950 vendor-advisory
- http://weechat.org/security/
- MDVSA-2013:136 vendor-advisory
- FEDORA-2012-18006 vendor-advisory