irc_mode_channel_update in plugins/irc/irc-mode.c in WeeChat through 2.7 allows remote attackers to cause a denial of service (buffer overflow and application crash) or possibly have unspecified other impact via a malformed IRC message 324 (channel mode).

The remote Ubuntu 16.04 ESM / 18.04 ESM / 20.04 ESM host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-5258-1 advisory.

    Stuart Nevans Locke discovered that WeeChat's relay plugin insecurely handled malformed websocket frames.
    A remote attacker in control of a server could possibly use this issue to cause denial of service in a     client. (CVE-2021-40516)

    Stuart Nevans Locke discovered that WeeChat insecurely handled certain IRC messages. A remote attacker in     control of a server could possibly use this issue to cause denial of service in a client. This issue only     affected Ubuntu 16.04 ESM and Ubuntu 18.04 ESM. (CVE-2020-9760)

    Stuart Nevans Locke discovered that WeeChat insecurely handled certain IRC messages. A remote     unauthenticated attacker could possibly use these issues to cause denial of service in a client. These     issues only affected Ubuntu 16.04 ESM and Ubuntu 18.04 ESM. (CVE-2020-9759, CVE-2020-8955)

    Joseph Bisch discovered that WeeChat's logger incorrectly handled certain memory operations when handling     log file names. A remote attacker could possibly use this issue to cause denial of service in a client.
    This issue only affected Ubuntu 16.04 ESM. (CVE-2017-14727)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-2770 advisory.

  - irc_mode_channel_update in plugins/irc/irc-mode.c in WeeChat through 2.7 allows remote attackers to cause     a denial of service (buffer overflow and application crash) or possibly have unspecified other impact via     a malformed IRC message 324 (channel mode). (CVE-2020-8955)

  - A Vulnerability of LG Electronic web OS TV Emulator could allow an attacker to escalate privileges and     overwrite certain files. This vulnerability is due to wrong environment setting. An attacker could exploit     this vulnerability through crafted configuration files and executable files. (CVE-2020-9759)

  - An issue was discovered in WeeChat before 2.7.1 (0.3.4 to 2.7 are affected). When a new IRC message 005 is     received with longer nick prefixes, a buffer overflow and possibly a crash can happen when a new mode is     set for a nick. (CVE-2020-9760)

  - WeeChat before 3.2.1 allows remote attackers to cause a denial of service (crash) via a crafted WebSocket     frame that trigger an out-of-bounds read in plugins/relay/relay-websocket.c in the Relay plugin.
    (CVE-2021-40516)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote host is affected by the vulnerability described in GLSA-202003-51 (WeeChat: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in WeeChat. Please review       the CVE identifiers referenced below for details.
  Impact :

    A remote attacker, by sending a specially crafted IRC message, could       possibly cause a Denial of Service condition.
  Workaround :

    There is no known workaround at this time.

Several issues have been found in weechat, a fast, light and extensible chat client. All issues are about crafted messages, that could result in a buffer overflow and application crash. This could cause a denial of service or possibly have other impact.

For Debian 8 'Jessie', these problems have been fixed in version 1.0.1-1+deb8u3.

We recommend that you upgrade your weechat packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

New version, fixes a lot of bugs (some of them security). In the same update, fixed up epel7 build to latest version as well.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for weechat fixes the following security issue :

  - CVE-2020-8955: Fixed a buffer overflow in     plugins/irc/irc-mode.c that allowed attackers to cause a     denial of service (bsc#1163889).

The WeeChat project reports :

Buffer overflow when receiving a malformed IRC message 324 (channel mode). (CVE-2020-8955)

Buffer overflow when a new IRC message 005 is received with longer nick prefixes.

Crash when receiving a malformed IRC message 352 (WHO).

ID	Name	Product	Family	Severity
183150	Ubuntu 16.04 ESM / 18.04 ESM / 20.04 ESM : WeeChat vulnerabilities (USN-5258-1)	Nessus	Ubuntu Local Security Checks	critical
153809	Debian DLA-2770-1 : weechat - LTS security update	Nessus	Debian Local Security Checks	critical
134926	GLSA-202003-51 : WeeChat: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	critical
134881	Debian DLA-2157-1 : weechat security update	Nessus	Debian Local Security Checks	critical
134639	Fedora 31 : weechat (2020-db890b4800)	Nessus	Fedora Local Security Checks	critical
134635	Fedora 30 : weechat (2020-4d232b48b8)	Nessus	Fedora Local Security Checks	critical
134153	openSUSE Security Update : weechat (openSUSE-2020-248)	Nessus	SuSE Local Security Checks	critical
133894	FreeBSD : WeeChat -- Multiple vulnerabilities (8e3f1812-54d9-11ea-8d49-d4c9ef517024)	Nessus	FreeBSD Local Security Checks	critical

Detections

Analytics

CVE-2020-8955

critical

Tenable Plugins

critical

critical

critical

critical

critical

critical

critical

critical