Security vulnerabilities in version 0.2.6

This page lists all known and fixed security vulnerabilities in version 0.2.6 (back to the list of all versions).

Overview: 3 vulnerabilities

WSA CVE Score Severity Issue Vulnerability type Scope Versions Fix Release date
WSA-2024-1 CVE-2024-46613 3.8
Integer overflow in loops on lists. Integer Overflow or Wraparound Core, Plugins 0.1.6 → 4.4.1 4.4.2
WSA-2011-1 CVE-2011-1428 5.3
Possible man-in-the-middle attack in TLS connection to IRC server. Improper certificate validation IRC 0.1.3 → 0.3.4 0.3.5
WSA-2009-1 CVE-2009-0661 7.5
Crash when receiving WeeChat color codes in IRC messages. Out-of-bounds read IRC 0.2.6 0.2.6.1

WSA-2024-1: [Core, Plugins] Integer overflow in loops on lists.

Vulnerability
CVE
CVE-2024-46613 [ MITRE / NVD ]
CVSS vector
AV:P/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L/E:X/RL:O/RC:C (detail)
CVSS score
3.8 / 10
Severity
low
Vulnerability type
Integer Overflow or Wraparound
Scope
Core, Plugins
Affected versions
0.1.6 → 4.4.1
Fixed version
4.4.2 () - ChangeLog
Tracker
issue #2178
Commits
Commit Commit Commit Commit Commit
Description
An integer overflow can happen when looping over items in a list.
This can only happen in rare conditions on 32 and 64-bit systems, as the list must contain more than 2,147,483,647 elements.
On 16-bit systems, this happens with a list that contains more than 32,767 elements.
Mitigation
There is no known mitigation.
The upgrade to the latest stable version is highly recommended.
Credit
The issue was discovered by Yiheng Cao.

WSA-2011-1: [IRC] Possible man-in-the-middle attack in TLS connection to IRC server.

Vulnerability
CVE
CVE-2011-1428 [ MITRE / NVD ]
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N (detail)
CVSS score
5.3 / 10
Severity
medium
Vulnerability type
Improper certificate validation (detail)
Scope
IRC
Affected versions
0.1.3 → 0.3.4
Fixed version
0.3.5 () - ChangeLog
Tracker
patch #7459
Commits
Commit
Description
Due to insufficient check of TLS certificate in IRC plugin, man-in-the-middle attackers can spoof a server via an arbitrary certificate.
Mitigation
There is no known mitigation.
The upgrade to the latest stable version is highly recommended.

WSA-2009-1: [IRC] Crash when receiving WeeChat color codes in IRC messages.

Vulnerability
CVE
CVE-2009-0661 [ MITRE / NVD ]
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H (detail)
CVSS score
7.5 / 10
Severity
high
Vulnerability type
Out-of-bounds read (detail)
Scope
IRC
Affected versions
0.2.6
Fixed version
0.2.6.1 () - ChangeLog
Tracker
bug #25862
Commits
Commit
Description
A crash happens when receiving some WeeChat internal color codes in IRC messages.
Mitigation
There is no known mitigation.
The upgrade to the latest stable version is highly recommended.

GitHub Mastodon Diaspora X

Copyright © 2003-2024 Sébastien Helleu — About WeeChat.org — Theme: light (dark)