WeeChat CVE-2017-8073 Buffer Overflow Vulnerability

Bugtraq ID:	97987
Class:	Boundary Condition Error
CVE:	CVE-2017-8073
Remote:	Yes
Local:	No
Published:	Apr 23 2017 12:00AM
Updated:	May 02 2017 12:09AM
Credit:	The vendor reported this issue.
Vulnerable:	FlashTux WeeChat 0.3.4 FlashTux WeeChat 0.2.6 0 FlashTux WeeChat 1.7.0 FlashTux WeeChat 0.3.9.2 FlashTux WeeChat 0.3.9.1 FlashTux WeeChat 0.3.9 FlashTux WeeChat 0.3.8 FlashTux WeeChat 0.3.7 FlashTux WeeChat 0.3.6 FlashTux WeeChat 0.2.6.1
Not Vulnerable:	FlashTux WeeChat 1.7.1

WeeChat CVE-2017-8073 Buffer Overflow Vulnerability

WeeChat is prone to a buffer-overflow vulnerability because it fails to properly bounds-check user-supplied input before copying it to an insufficiently sized memory buffer.

An attacker can exploit this issue to cause a denial-of-service conditions. Due to the nature of this issue, code-execution may be possible but this has not been confirmed.

Versions prior to WeeChat 1.7.1 are vulnerable.

WeeChat CVE-2017-8073 Buffer Overflow Vulnerability

Currently, we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

WeeChat CVE-2017-8073 Buffer Overflow Vulnerability

Solution:
Updates are available. Please see the references for more information.

WeeChat CVE-2017-8073 Buffer Overflow Vulnerability

References:

• WeeChat Homepage (FlashTux)
  
• Buffer overflow when removing quotes in DCC filename. (weechat)
  
• irc: fix parsing of DCC filename (GitHub)