Description
logger.c in the logger plugin in WeeChat before 1.9.1 allows a crash via strftime date/time specifiers, because a buffer is not initialized.
References (4)
Core 4
Core References
Third Party Advisory, VDB Entry vdb-entry
x_refsource_bid
http://www.securityfocus.com/bid/101003
Vendor Advisory x_refsource_confirm
https://weechat.org/download/security/
Patch, Third Party Advisory x_refsource_confirm
https://github.com/weechat/weechat/commit/f105c6f0b56fb5687b2d2aedf37cb1d1b434d556
Release Notes, Vendor Advisory x_refsource_confirm
https://weechat.org/news/98/20170923-Version-1.9.1-security-release/
Scores
CVSS v3
7.5
EPSS
0.0066
EPSS Percentile
71.2%
Attack Vector
NETWORK
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Details
CWE
CWE-119
Status
published
Products (1)
weechat/logger
Published
Sep 23, 2017
Tracked Since
Feb 18, 2026