CVE-2017-8073
HighSummary
WeeChat before 1.7.1 allows a remote crash by sending a filename via DCC to the IRC plugin. This occurs in the irc_ctcp_dcc_filename_without_quotes function during quote removal, leading to a buffer overflow.
Risk Assessment
An attacker can exploit this vulnerability to remotely crash the service, potentially causing downtime for users.
Recommendation
It is recommended to update WeeChat to version 1.7.1 or later to mitigate this vulnerability.
Other vulnerabilities in WeeChat
See all- CVE-2026-53525High
WeeChat versions 0.3.1 through 4.9.0 use non-constant-time string comparison functions (weechat_strcasecmp and strcmp) to verify password hashes and plaintext passwords in relay authentication. An attacker can exploit timing differences to extract the server-computed hash character by character, then authenticate without knowing the password. Version 4.9.1 fixes the issue.
- CVE-2026-53524Medium
WeeChat versions 4.3.0 through 4.9.0 have a vulnerability in the WebSocket permessage-deflate decompression function relay_websocket_inflate() in the relay module, which has no upper bound on output size. An authenticated relay user can send a small compressed WebSocket frame (~100 bytes) that decompresses to gigabytes, exhausting all server memory and crashing the entire WeeChat process.
Original NVD description (English source)
WeeChat before 1.7.1 allows a remote crash by sending a filename via DCC to the IRC plugin. This occurs in the irc_ctcp_dcc_filename_without_quotes function during quote removal, with a buffer overflow.