CVE-2017-14727: Buffer Overflow
logger.c in the logger plugin in WeeChat before 1.9.1 allows a crash via strftime date/time specifiers, because a buffer is not initialized.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
alpine/weechatto a version that resolves this vulnerability.Fixed in 1.9.1-r0 - Upgrade
Upgrade
alpine/weechatto a version that resolves this vulnerability.Fixed in 1.6.0-r2 - Upgrade
Upgrade
alpine/weechatto a version that resolves this vulnerability.Fixed in 1.7.1-r2
Event History
Frequently Asked Questions
What is the severity of CVE-2017-14727?
CVE-2017-14727 has a medium severity impact due to the potential for application crashes.
How do I fix CVE-2017-14727?
To fix CVE-2017-14727, update WeeChat to version 1.9.1 or later where the vulnerability has been addressed.
What versions are affected by CVE-2017-14727?
CVE-2017-14727 affects all versions of WeeChat prior to 1.9.1.
What causes the vulnerability in CVE-2017-14727?
CVE-2017-14727 is caused by uninitialized buffers in the logger plugin's handling of strftime date/time specifiers.
Is there a workaround for CVE-2017-14727?
There is no known effective workaround for CVE-2017-14727 other than updating to the fixed version.