Overview: 1 vulnerability
| WSA |
CVE |
Score |
Severity |
Issue |
Vulnerability type |
Scope |
Versions |
Fix
| Release date |
|
| WSA-2013-2 |
- |
5.5 |
|
Crash on send of unknown commands to IRC server. |
Access of uninitialized pointer |
IRC |
0.3.0 → 0.4.0 |
0.4.1 |
|
WSA-2013-2: [IRC] Crash on send of unknown commands to IRC server.
Vulnerability
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
(
detail)
Access of uninitialized pointer
(
detail)
Affected versions
0.3.0 → 0.4.0
Description
Strings are built with uncontrolled format when unknown IRC commands are sent to server, if option
irc.network.send_unknown_commands is enabled.
Mitigation
There are multiple ways to mitigate this issue:
- Turn off option to send unknown commands:
/set irc.network.send_unknown_commands off
- Do not use formatting chars like "%" when sending unknown commands to server.