CVE-2012-5854 — Improper Restriction of Operations within the Bounds of a Memory Buffer in Weechat

CWE-119 — Improper Restriction of Operations within the Bounds of a Memory Buffer5 documents5 sources
Severity
7.5HIGHNVD
EPSS
6.6%
top 8.79%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
WeechatDebian WeechatFlashtux Weechat
Timeline
PublishedNov 19
Latest updateMay 17

Description

Heap-based buffer overflow in WeeChat 0.3.6 through 0.3.9 allows remote attackers to cause a denial of service (crash or hang) and possibly execute arbitrary code via crafted IRC colors that are not properly decoded.

CVSS vector

AV:N/AC:L/C:P/I:P/A:PExploitability: 10.0 | Impact: 6.4

Affected Packages3 packages

▶debiandebian/weechat< weechat 0.3.9.1-1 (bookworm)
▶Debianweechat/weechat< 0.3.9.1-1+3
▶NVDflashtux/weechat4 versions+3

🔴Vulnerability Details

2
GHSA
GHSA-rm2r-8wh7-276p: Heap-based buffer overflow in WeeChat 0↗2022-05-17
▶
OSV
CVE-2012-5854: Heap-based buffer overflow in WeeChat 0↗2012-11-19
▶

📋Vendor Advisories

1
Debian
CVE-2012-5854: weechat - Heap-based buffer overflow in WeeChat 0.3.6 through 0.3.9 allows remote attacker...↗2012
▶

💬Community

1
Bugzilla
CVE-2012-5854 weechat: Heap-based buffer overflow when decoding IRC colors↗2012-11-09
▶