Heap-based buffer overflow in WeeChat - #VU164403

Vulnerability details

The vulnerability allows a remote attacker to cause a denial of service by crashing the client.

The vulnerability exists due to a heap-based buffer overflow in WeeChat IRC plugin's irc_nick_set_prefix when indexing stale nick prefix buffers without bounds checks after automatic reconnect. A remote attacker can operate an IRC server the victim connects to, send pre-registration JOIN and 005 messages containing PREFIX=(), force a disconnect, then send a 353 message with a '+'-prefixed nick after automatic reconnect to trigger out-of-bounds reads and writes and crash the client.

Affected software

Remediation

External References

• https://github.com/weechat/weechat/security/advisories/GHSA-xj8h-x2w9-m8m6

Related Security Bulletins

• Multiple vulnerabilities in WeeChat