{"api_version":"1","generated_at":"2026-07-23T06:38:54+00:00","cve":"CVE-2010-2785","urls":{"html":"https://cve.report/CVE-2010-2785","api":"https://cve.report/api/cve/CVE-2010-2785.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2010-2785","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2010-2785"},"summary":{"title":"CVE-2010-2785","description":"The IRC Protocol component in KVIrc 3.x and 4.x before r4693 does not properly handle \\ (backslash) characters, which allows remote authenticated users to execute arbitrary CTCP commands via vectors involving \\r and \\40 sequences, a different vulnerability than CVE-2010-2451 and CVE-2010-2452.","state":"PUBLISHED","assigner":"redhat","published_at":"2010-08-02 20:40:01","updated_at":"2026-04-29 01:13:23"},"problem_types":["NVD-CWE-Other","n/a"],"metrics":[{"version":"2.0","source":"nvd@nist.gov","type":"Primary","score":"6.5","severity":"","vector":"AV:N/AC:L/Au:S/C:P/I:P/A:P","data":{"version":"2.0","vectorString":"AV:N/AC:L/Au:S/C:P/I:P/A:P","baseScore":6.5,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"SINGLE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"}}],"references":[{"url":"http://lists.opensuse.org/opensuse-security-announce/2010-08/msg00001.html","name":"http://lists.opensuse.org/opensuse-security-announce/2010-08/msg00001.html","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"[security-announce] SUSE Security Summary Report: SUSE-SR:2010:014","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://svn.kvirc.de/kvirc/ticket/858","name":"https://svn.kvirc.de/kvirc/ticket/858","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Patch"],"title":"GitHub - kvirc/KVIrc: The KVIrc IRC Client","mime":"text/html","httpstatus":"-1","archivestatus":"200"},{"url":"http://secunia.com/advisories/40796","name":"http://secunia.com/advisories/40796","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Vendor Advisory"],"title":"Fedora update for kvirc - Advisories - Community","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.osvdb.org/66648","name":"http://www.osvdb.org/66648","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"","mime":"","httpstatus":"-1","archivestatus":"0"},{"url":"http://bugs.gentoo.org/show_bug.cgi?id=330111","name":"http://bugs.gentoo.org/show_bug.cgi?id=330111","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"330111 – <net-irc/kvirc-4.1_pre4693: Remote command execution (CVE-2010-2785)","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://lists.fedoraproject.org/pipermail/package-announce/2010-July/044643.html","name":"http://lists.fedoraproject.org/pipermail/package-announce/2010-July/044643.html","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"[SECURITY] Fedora 12 Update: kvirc-4.0.0-3.fc12","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://marc.info/?l=oss-security&m=128041011428629&w=2","name":"http://marc.info/?l=oss-security&m=128041011428629&w=2","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Patch"],"title":"'Re: [oss-security] CVE Request -- KVIrc -- Remote CTCP commands' - MARC","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://secunia.com/advisories/40727","name":"http://secunia.com/advisories/40727","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Vendor Advisory"],"title":"KVIrc Failed DCC Handshake Notification Command Injection Vulnerability - Advisories - Community","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://openwall.com/lists/oss-security/2010/07/28/1","name":"http://openwall.com/lists/oss-security/2010/07/28/1","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Patch"],"title":"oss-security - CVE Request -- KVIrc -- Remote CTCP commands execution via specially-crafted\n CTCP parameter","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://svn.kvirc.de/kvirc/changeset/4693","name":"https://svn.kvirc.de/kvirc/changeset/4693","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Patch"],"title":"GitHub - kvirc/KVIrc: The KVIrc IRC Client","mime":"text/html","httpstatus":"-1","archivestatus":"200"},{"url":"http://lists.fedoraproject.org/pipermail/package-announce/2010-July/044625.html","name":"http://lists.fedoraproject.org/pipermail/package-announce/2010-July/044625.html","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"[SECURITY] Fedora 13 Update: kvirc-4.0.0-3.fc13","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://www.cve.org/CVERecord?id=CVE-2010-2785","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2010-2785","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"n/a","product":"n/a","version":"affected n/a","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2010","cve_id":"2785","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"kvirc","cpe5":"kvirc","cpe6":"3.0.0","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2010","cve_id":"2785","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"kvirc","cpe5":"kvirc","cpe6":"3.0.0","cpe7":"beta1","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2010","cve_id":"2785","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"kvirc","cpe5":"kvirc","cpe6":"3.0.0","cpe7":"beta2","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2010","cve_id":"2785","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"kvirc","cpe5":"kvirc","cpe6":"3.0.1","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2010","cve_id":"2785","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"kvirc","cpe5":"kvirc","cpe6":"3.4.0","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2010","cve_id":"2785","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"kvirc","cpe5":"kvirc","cpe6":"3.4.2","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2010","cve_id":"2785","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"kvirc","cpe5":"kvirc","cpe6":"3.4.2","cpe7":"rc1","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2010","cve_id":"2785","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"kvirc","cpe5":"kvirc","cpe6":"4.0.0","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2010","cve_id":"2785","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"kvirc","cpe5":"kvirc","cpe6":"4.0.2","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"adp":[{"providerMetadata":{"dateUpdated":"2024-08-07T02:46:48.031Z","orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE"},"references":[{"tags":["x_refsource_CONFIRM","x_transferred"],"url":"http://bugs.gentoo.org/show_bug.cgi?id=330111"},{"name":"FEDORA-2010-11524","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred"],"url":"http://lists.fedoraproject.org/pipermail/package-announce/2010-July/044643.html"},{"name":"40796","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred"],"url":"http://secunia.com/advisories/40796"},{"name":"66648","tags":["vdb-entry","x_refsource_OSVDB","x_transferred"],"url":"http://www.osvdb.org/66648"},{"tags":["x_refsource_CONFIRM","x_transferred"],"url":"https://svn.kvirc.de/kvirc/changeset/4693"},{"name":"[oss-security] 20100729 Re: CVE Request -- KVIrc -- Remote CTCP commands execution via specially-crafted CTCP parameter","tags":["mailing-list","x_refsource_MLIST","x_transferred"],"url":"http://marc.info/?l=oss-security&m=128041011428629&w=2"},{"name":"SUSE-SR:2010:014","tags":["vendor-advisory","x_refsource_SUSE","x_transferred"],"url":"http://lists.opensuse.org/opensuse-security-announce/2010-08/msg00001.html"},{"name":"[oss-security] 20100728 CVE Request -- KVIrc -- Remote CTCP commands execution via specially-crafted CTCP parameter","tags":["mailing-list","x_refsource_MLIST","x_transferred"],"url":"http://openwall.com/lists/oss-security/2010/07/28/1"},{"name":"40727","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred"],"url":"http://secunia.com/advisories/40727"},{"tags":["x_refsource_CONFIRM","x_transferred"],"url":"https://svn.kvirc.de/kvirc/ticket/858"},{"name":"FEDORA-2010-11506","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred"],"url":"http://lists.fedoraproject.org/pipermail/package-announce/2010-July/044625.html"}],"title":"CVE Program Container"}],"cna":{"affected":[{"product":"n/a","vendor":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"datePublic":"2010-07-28T00:00:00.000Z","descriptions":[{"lang":"en","value":"The IRC Protocol component in KVIrc 3.x and 4.x before r4693 does not properly handle \\ (backslash) characters, which allows remote authenticated users to execute arbitrary CTCP commands via vectors involving \\r and \\40 sequences, a different vulnerability than CVE-2010-2451 and CVE-2010-2452."}],"problemTypes":[{"descriptions":[{"description":"n/a","lang":"en","type":"text"}]}],"providerMetadata":{"dateUpdated":"2010-09-09T09:00:00.000Z","orgId":"53f830b8-0a3f-465b-8143-3b8a9948e749","shortName":"redhat"},"references":[{"tags":["x_refsource_CONFIRM"],"url":"http://bugs.gentoo.org/show_bug.cgi?id=330111"},{"name":"FEDORA-2010-11524","tags":["vendor-advisory","x_refsource_FEDORA"],"url":"http://lists.fedoraproject.org/pipermail/package-announce/2010-July/044643.html"},{"name":"40796","tags":["third-party-advisory","x_refsource_SECUNIA"],"url":"http://secunia.com/advisories/40796"},{"name":"66648","tags":["vdb-entry","x_refsource_OSVDB"],"url":"http://www.osvdb.org/66648"},{"tags":["x_refsource_CONFIRM"],"url":"https://svn.kvirc.de/kvirc/changeset/4693"},{"name":"[oss-security] 20100729 Re: CVE Request -- KVIrc -- Remote CTCP commands execution via specially-crafted CTCP parameter","tags":["mailing-list","x_refsource_MLIST"],"url":"http://marc.info/?l=oss-security&m=128041011428629&w=2"},{"name":"SUSE-SR:2010:014","tags":["vendor-advisory","x_refsource_SUSE"],"url":"http://lists.opensuse.org/opensuse-security-announce/2010-08/msg00001.html"},{"name":"[oss-security] 20100728 CVE Request -- KVIrc -- Remote CTCP commands execution via specially-crafted CTCP parameter","tags":["mailing-list","x_refsource_MLIST"],"url":"http://openwall.com/lists/oss-security/2010/07/28/1"},{"name":"40727","tags":["third-party-advisory","x_refsource_SECUNIA"],"url":"http://secunia.com/advisories/40727"},{"tags":["x_refsource_CONFIRM"],"url":"https://svn.kvirc.de/kvirc/ticket/858"},{"name":"FEDORA-2010-11506","tags":["vendor-advisory","x_refsource_FEDORA"],"url":"http://lists.fedoraproject.org/pipermail/package-announce/2010-July/044625.html"}],"x_legacyV4Record":{"CVE_data_meta":{"ASSIGNER":"secalert@redhat.com","ID":"CVE-2010-2785","STATE":"PUBLIC"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"n/a","version":{"version_data":[{"version_value":"n/a"}]}}]},"vendor_name":"n/a"}]}},"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"The IRC Protocol component in KVIrc 3.x and 4.x before r4693 does not properly handle \\ (backslash) characters, which allows remote authenticated users to execute arbitrary CTCP commands via vectors involving \\r and \\40 sequences, a different vulnerability than CVE-2010-2451 and CVE-2010-2452."}]},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"n/a"}]}]},"references":{"reference_data":[{"name":"http://bugs.gentoo.org/show_bug.cgi?id=330111","refsource":"CONFIRM","url":"http://bugs.gentoo.org/show_bug.cgi?id=330111"},{"name":"FEDORA-2010-11524","refsource":"FEDORA","url":"http://lists.fedoraproject.org/pipermail/package-announce/2010-July/044643.html"},{"name":"40796","refsource":"SECUNIA","url":"http://secunia.com/advisories/40796"},{"name":"66648","refsource":"OSVDB","url":"http://www.osvdb.org/66648"},{"name":"https://svn.kvirc.de/kvirc/changeset/4693","refsource":"CONFIRM","url":"https://svn.kvirc.de/kvirc/changeset/4693"},{"name":"[oss-security] 20100729 Re: CVE Request -- KVIrc -- Remote CTCP commands execution via specially-crafted CTCP parameter","refsource":"MLIST","url":"http://marc.info/?l=oss-security&m=128041011428629&w=2"},{"name":"SUSE-SR:2010:014","refsource":"SUSE","url":"http://lists.opensuse.org/opensuse-security-announce/2010-08/msg00001.html"},{"name":"[oss-security] 20100728 CVE Request -- KVIrc -- Remote CTCP commands execution via specially-crafted CTCP parameter","refsource":"MLIST","url":"http://openwall.com/lists/oss-security/2010/07/28/1"},{"name":"40727","refsource":"SECUNIA","url":"http://secunia.com/advisories/40727"},{"name":"https://svn.kvirc.de/kvirc/ticket/858","refsource":"CONFIRM","url":"https://svn.kvirc.de/kvirc/ticket/858"},{"name":"FEDORA-2010-11506","refsource":"FEDORA","url":"http://lists.fedoraproject.org/pipermail/package-announce/2010-July/044625.html"}]}}}},"cveMetadata":{"assignerOrgId":"53f830b8-0a3f-465b-8143-3b8a9948e749","assignerShortName":"redhat","cveId":"CVE-2010-2785","datePublished":"2010-08-02T19:00:00.000Z","dateReserved":"2010-07-22T00:00:00.000Z","dateUpdated":"2024-08-07T02:46:48.031Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.1"},"nvd":{"publishedDate":"2010-08-02 20:40:01","lastModifiedDate":"2026-04-29 01:13:23","problem_types":["NVD-CWE-Other","n/a"],"metrics":{"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:S/C:P/I:P/A:P","baseScore":6.5,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"SINGLE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"},"baseSeverity":"MEDIUM","exploitabilityScore":8,"impactScore":6.4,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}]},"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:kvirc:kvirc:3.0.0:*:*:*:*:*:*:*","matchCriteriaId":"24A0A10B-8DDC-4C5C-9E71-DE35B5AD4F6C"},{"vulnerable":true,"criteria":"cpe:2.3:a:kvirc:kvirc:3.0.0:beta1:*:*:*:*:*:*","matchCriteriaId":"A97539C0-DAFD-4187-9A31-93F3AF850588"},{"vulnerable":true,"criteria":"cpe:2.3:a:kvirc:kvirc:3.0.0:beta2:*:*:*:*:*:*","matchCriteriaId":"CB5277BA-B51B-4086-960A-3351EAB9ACA8"},{"vulnerable":true,"criteria":"cpe:2.3:a:kvirc:kvirc:3.0.1:*:*:*:*:*:*:*","matchCriteriaId":"37C39663-F342-4115-B3D5-F97D3525A95A"},{"vulnerable":true,"criteria":"cpe:2.3:a:kvirc:kvirc:3.4.0:*:*:*:*:*:*:*","matchCriteriaId":"B91ED333-CB47-401A-894B-4A1CF5AED8E9"},{"vulnerable":true,"criteria":"cpe:2.3:a:kvirc:kvirc:3.4.2:*:*:*:*:*:*:*","matchCriteriaId":"B6742F39-882E-47E3-A375-B43C7ED771C3"},{"vulnerable":true,"criteria":"cpe:2.3:a:kvirc:kvirc:3.4.2:rc1:*:*:*:*:*:*","matchCriteriaId":"2D0F8E8D-E1B3-4838-A7E5-9D1678E848CD"},{"vulnerable":true,"criteria":"cpe:2.3:a:kvirc:kvirc:4.0.0:*:*:*:*:*:*:*","matchCriteriaId":"63A25E20-68DF-4075-95D7-7652A7E2085B"},{"vulnerable":true,"criteria":"cpe:2.3:a:kvirc:kvirc:4.0.2:*:*:*:*:*:*:*","matchCriteriaId":"C6CEC61C-E71C-4B70-B127-26E2DE2BB27F"}]}]}]},"legacy_mitre":{"record":{"CveYear":"2010","CveId":"2785","Ordinal":"1","Title":"CVE-2010-2785","CVE":"CVE-2010-2785","Year":"2010"},"notes":[{"CveYear":"2010","CveId":"2785","Ordinal":"1","NoteData":"The IRC Protocol component in KVIrc 3.x and 4.x before r4693 does not properly handle \\ (backslash) characters, which allows remote authenticated users to execute arbitrary CTCP commands via vectors involving \\r and \\40 sequences, a different vulnerability than CVE-2010-2451 and CVE-2010-2452.","Type":"Description","Title":"CVE-2010-2785"},{"CveYear":"2010","CveId":"2785","Ordinal":"2","NoteData":"2010-08-02","Type":"Other","Title":"Published"},{"CveYear":"2010","CveId":"2785","Ordinal":"3","NoteData":"2010-09-09","Type":"Other","Title":"Modified"}]}}}