WeeChat :: documentation

Security vulnerabilities in version 0.2.6

This page lists all known and fixed security vulnerabilities in version 0.2.6 (back to the list of all versions).

Overview: 3 vulnerabilities

WSA	CVE	Score	Issue	Vulnerability type	Scope	Versions	Fix	Release date
WSA-2024-1	CVE-2024-46613	3.8	Integer overflow in loops on lists.	Integer Overflow or Wraparound	Core, Plugins	0.1.6 → 4.4.1	4.4.2	Sep 8, 2024
WSA-2011-1	CVE-2011-1428	5.3	Possible man-in-the-middle attack in TLS connection to IRC server.	Improper certificate validation	IRC	0.1.3 → 0.3.4	0.3.5	May 15, 2011
WSA-2009-1	CVE-2009-0661	7.5	Crash when receiving WeeChat color codes in IRC messages.	Out-of-bounds read	IRC	0.2.6	0.2.6.1	Mar 14, 2009

WSA-2024-1: [Core, Plugins] Integer overflow in loops on lists.

Vulnerability

CVE

CVE-2024-46613 [ MITRE / NVD ]

CVSS vector

AV:P/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L/E:X/RL:O/RC:C (detail)

CVSS score

3.8 / 10

Severity

low

Vulnerability type

Integer Overflow or Wraparound (detail)

Scope

Core, Plugins

Affected versions

0.1.6 → 4.4.1

Fixed version

4.4.2 (Sep 8, 2024) - ChangeLog

Tracker

issue #2178

Commits

Description

An integer overflow can happen when looping over items in a list.
This can only happen in rare conditions on 32 and 64-bit systems, as the list must contain more than 2,147,483,647 elements.
On 16-bit systems, this happens with a list that contains more than 32,767 elements.

Mitigation

There is no known mitigation.
The upgrade to the latest stable version is highly recommended.

Credit

The issue was discovered by Yiheng Cao.

WSA-2011-1: [IRC] Possible man-in-the-middle attack in TLS connection to IRC server.

Vulnerability

CVE

CVE-2011-1428 [ MITRE / NVD ]

CVSS vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N (detail)

CVSS score

5.3 / 10

Severity

medium

Vulnerability type

Improper certificate validation (detail)

Scope

IRC

Affected versions

0.1.3 → 0.3.4

Fixed version

0.3.5 (May 15, 2011) - ChangeLog

Tracker

patch #7459

Commits

Description

Due to insufficient check of TLS certificate in IRC plugin, man-in-the-middle attackers can spoof a server via an arbitrary certificate.

Mitigation

There is no known mitigation.
The upgrade to the latest stable version is highly recommended.

WSA-2009-1: [IRC] Crash when receiving WeeChat color codes in IRC messages.

Vulnerability

CVE

CVE-2009-0661 [ MITRE / NVD ]

CVSS vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H (detail)

CVSS score

7.5 / 10

Severity

high

Vulnerability type

Out-of-bounds read (detail)

Scope

IRC

Affected versions

0.2.6

Fixed version

0.2.6.1 (Mar 14, 2009) - ChangeLog

Tracker

bug #25862

Commits

Description

A crash happens when receiving some WeeChat internal color codes in IRC messages.

Mitigation

There is no known mitigation.
The upgrade to the latest stable version is highly recommended.