Heap-based buffer overflow in WeeChat - #VU164402

Vulnerability details

The vulnerability allows a remote privileged user to corrupt heap memory and cause a denial of service in WeeChat's parent process.

The vulnerability exists due to a heap-based buffer overflow in relay_weechat_msg_add_hdata when expanding hdata paths without checking accumulated output against the allocated buffer size. A remote privileged user can authenticate to an enabled relay port and send an hdata path starting with irc_channel_speaking:0x1 followed by repeated /next_nick segments to overwrite adjacent heap chunks and crash the process, bypassing relay.network.commands restrictions.

Affected software

Remediation

External References

• https://github.com/weechat/weechat/security/advisories/GHSA-8wr2-x42m-7fxv

Related Security Bulletins

• Multiple vulnerabilities in WeeChat