CVE-2020-8955

irc_mode_channel_update in plugins/irc/irc-mode.c in WeeChat through 2.7 allows remote attackers to cause a denial of service (buffer overflow and application crash) or possibly have unspecified other impact via a malformed IRC message 324 (channel mode).

Published: Feb 12, 2020
Updated: Apr 14, 2023
CVE: CVE-2020-8955
Severity: Critical
Exploit:

CVSS v3:

Severity: Critical
Score: 9.8
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CVSS v2:

Severity: High
Score: 7.5
AV:N/AC:L/Au:N/C:P/I:P/A:P

CWEs:

CWE-120

Affected Software
References

Software	From	Fixed in
weechat / weechat	0.3.8	2.7.x
fedoraproject / fedora	30	30.x
fedoraproject / fedora	31	31.x
fedoraproject / fedora	32	32.x
opensuse / leap	15.1	15.1.x
opensuse / backports_sle	15.0-sp1	15.0-sp1.x
opensuse / backports_sle	15.0	15.0.x
debian / debian_linux	8.0	8.0.x
debian / debian_linux	9.0	9.0.x

http://lists.opensuse.org/opensuse-security-announce/2020-02/msg00032.html
https://github.com/weechat/weechat/commit/6f4f147d8e86adf9ad34a8ffd7e7f1f23a7e74da
https://lists.debian.org/debian-lts-announce/2020/03/msg00031.html
https://lists.debian.org/debian-lts-announce/2021/09/msg00018.html
https://lists.fedoraproject.org/archives/list/[email protected]/message/4ASRTCQFFDAAK347URWNDH6NSED2BGNY/
https://lists.fedoraproject.org/archives/list/[email protected]/message/ER23GT23US5JXDLUZAMGMWXKZ74MI4S2/
https://lists.fedoraproject.org/archives/list/[email protected]/message/M3LAJTLI3LWZRNCFYJ7PCBBTHUMCCBHH/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4ASRTCQFFDAAK347URWNDH6NSED2BGNY/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ER23GT23US5JXDLUZAMGMWXKZ74MI4S2/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/M3LAJTLI3LWZRNCFYJ7PCBBTHUMCCBHH/
https://security.gentoo.org/glsa/202003-51
https://weechat.org/doc/security/

Vulnerability Database

290,020

CVE-2020-8955