CVE-2017-14727

NameCVE-2017-14727
Descriptionlogger.c in the logger plugin in WeeChat before 1.9.1 allows a crash via strftime date/time specifiers, because a buffer is not initialized.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, Mageia, GitHub code/issues, web search, more)
ReferencesDLA-1111-1
NVD severitymedium (attack range: remote)
Debian Bugs876553

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
weechat (PTS)jessie1.0.1-1+deb8u2fixed
jessie (security)1.0.1-1+deb8u1vulnerable
stretch1.6-1+deb9u2fixed
buster, sid2.1-2fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
weechatsource(unstable)1.9.1-1medium876553
weechatsourcejessie1.0.1-1+deb8u2medium
weechatsourcestretch1.6-1+deb9u2medium
weechatsourcewheezy0.3.8-1+deb7u3mediumDLA-1111-1

Notes

Fixed by: https://github.com/weechat/weechat/commit/f105c6f0b56fb5687b2d2aedf37cb1d1b434d556

Search for package or bug name: Reporting problems