ZNC before 1.7.3-rc1 allows an existing remote user to cause a Denial of Service (crash) via invalid encoding.

This update for znc to version 1.7.4 fixes the following issues :

Security issues fixed :

  - CVE-2019-12816: Fixed a remote code execution in     Modules.cpp (boo#1138572).

  - CVE-2019-9917: Fixed a denial of service on invalid     encoding (boo#1130360).

Two vulnerabilities were discovered in the ZNC IRC bouncer which could result in remote code execution (CVE-2019-12816 ) or denial of service via invalid encoding (CVE-2019-9917 ).

Fixes CVE-2019-9917

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

It was discovered that ZNC incorrectly handled certain invalid encodings. An authenticated remote user could use this issue to cause ZNC to crash, resulting in a denial of service, or possibly execute arbitrary code.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for znc to version 1.7.2 fixes the following issue :

Security issue fixed :

  - CVE-2019-9917: Fixed an issue where due to invalid     encoding znc was crashing (bsc#1130360).

Mitre reports :

ZNC before 1.7.3-rc1 allows an existing remote user to cause a Denial of Service (crash) via invalid encoding.

ID	Name	Product	Family	Severity
126906	openSUSE Security Update : znc (openSUSE-2019-1775)	Nessus	SuSE Local Security Checks	high
125929	Debian DSA-4463-1 : znc - security update	Nessus	Debian Local Security Checks	high
124516	Fedora 30 : znc (2019-8790e70a89)	Nessus	Fedora Local Security Checks	medium
124251	Fedora 29 : znc (2019-d5ad4a435c)	Nessus	Fedora Local Security Checks	medium
124245	Fedora 28 : znc (2019-64ed5e4dfa)	Nessus	Fedora Local Security Checks	medium
124191	Ubuntu 18.10 : ZNC vulnerability (USN-3950-1)	Nessus	Ubuntu Local Security Checks	medium
123820	openSUSE Security Update : znc (openSUSE-2019-1166)	Nessus	SuSE Local Security Checks	medium
123539	FreeBSD : znc -- Denial of Service (b22d6d4c-53b9-11e9-9310-28d244aee256)	Nessus	FreeBSD Local Security Checks	medium

Detections

Analytics

CVE-2019-9917

medium

Tenable Plugins

high

high

medium

medium

medium

medium

medium

medium