irc_mode_channel_update in plugins/irc/irc-mode.c in WeeChat through 2.7 allows remote attackers to cause a denial of service (buffer overflow and application crash) or possibly have unspecified other impact via a malformed IRC message 324 (channel mode).

The remote Ubuntu 16.04 ESM / 18.04 ESM / 20.04 ESM host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-5258-1 advisory.

  - logger.c in the logger plugin in WeeChat before 1.9.1 allows a crash via strftime date/time specifiers,     because a buffer is not initialized. (CVE-2017-14727)

  - irc_mode_channel_update in plugins/irc/irc-mode.c in WeeChat through 2.7 allows remote attackers to cause     a denial of service (buffer overflow and application crash) or possibly have unspecified other impact via     a malformed IRC message 324 (channel mode). (CVE-2020-8955)

  - A Vulnerability of LG Electronic web OS TV Emulator could allow an attacker to escalate privileges and     overwrite certain files. This vulnerability is due to wrong environment setting. An attacker could exploit     this vulnerability through crafted configuration files and executable files. (CVE-2020-9759)

  - An issue was discovered in WeeChat before 2.7.1 (0.3.4 to 2.7 are affected). When a new IRC message 005 is     received with longer nick prefixes, a buffer overflow and possibly a crash can happen when a new mode is     set for a nick. (CVE-2020-9760)

  - WeeChat before 3.2.1 allows remote attackers to cause a denial of service (crash) via a crafted WebSocket     frame that trigger an out-of-bounds read in plugins/relay/relay-websocket.c in the Relay plugin.
    (CVE-2021-40516)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-2770 advisory.

  - irc_mode_channel_update in plugins/irc/irc-mode.c in WeeChat through 2.7 allows remote attackers to cause     a denial of service (buffer overflow and application crash) or possibly have unspecified other impact via     a malformed IRC message 324 (channel mode). (CVE-2020-8955)

  - A Vulnerability of LG Electronic web OS TV Emulator could allow an attacker to escalate privileges and     overwrite certain files. This vulnerability is due to wrong environment setting. An attacker could exploit     this vulnerability through crafted configuration files and executable files. (CVE-2020-9759)

  - An issue was discovered in WeeChat before 2.7.1 (0.3.4 to 2.7 are affected). When a new IRC message 005 is     received with longer nick prefixes, a buffer overflow and possibly a crash can happen when a new mode is     set for a nick. (CVE-2020-9760)

  - WeeChat before 3.2.1 allows remote attackers to cause a denial of service (crash) via a crafted WebSocket     frame that trigger an out-of-bounds read in plugins/relay/relay-websocket.c in the Relay plugin.
    (CVE-2021-40516)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote host is affected by the vulnerability described in GLSA-202003-51 (WeeChat: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in WeeChat. Please review       the CVE identifiers referenced below for details.
  Impact :

    A remote attacker, by sending a specially crafted IRC message, could       possibly cause a Denial of Service condition.
  Workaround :

    There is no known workaround at this time.

Several issues have been found in weechat, a fast, light and extensible chat client. All issues are about crafted messages, that could result in a buffer overflow and application crash. This could cause a denial of service or possibly have other impact.

For Debian 8 'Jessie', these problems have been fixed in version 1.0.1-1+deb8u3.

We recommend that you upgrade your weechat packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

New version, fixes a lot of bugs (some of them security). In the same update, fixed up epel7 build to latest version as well.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for weechat fixes the following security issue :

  - CVE-2020-8955: Fixed a buffer overflow in     plugins/irc/irc-mode.c that allowed attackers to cause a     denial of service (bsc#1163889).

The WeeChat project reports :

Buffer overflow when receiving a malformed IRC message 324 (channel mode). (CVE-2020-8955)

Buffer overflow when a new IRC message 005 is received with longer nick prefixes.

Crash when receiving a malformed IRC message 352 (WHO).

ID	Name	Product	Family	Severity
183150	Ubuntu 16.04 ESM / 18.04 ESM / 20.04 ESM : WeeChat vulnerabilities (USN-5258-1)	Nessus	Ubuntu Local Security Checks	critical
153809	Debian DLA-2770-1 : weechat - LTS security update	Nessus	Debian Local Security Checks	critical
134926	GLSA-202003-51 : WeeChat: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	critical
134881	Debian DLA-2157-1 : weechat security update	Nessus	Debian Local Security Checks	critical
134639	Fedora 31 : weechat (2020-db890b4800)	Nessus	Fedora Local Security Checks	critical
134635	Fedora 30 : weechat (2020-4d232b48b8)	Nessus	Fedora Local Security Checks	critical
134153	openSUSE Security Update : weechat (openSUSE-2020-248)	Nessus	SuSE Local Security Checks	critical
133894	FreeBSD : WeeChat -- Multiple vulnerabilities (8e3f1812-54d9-11ea-8d49-d4c9ef517024)	Nessus	FreeBSD Local Security Checks	critical

Detections

Analytics

CVE-2020-8955

critical

Tenable Plugins

critical

critical

critical

critical

critical

critical

critical

critical