CVE-2017-14727

NameCVE-2017-14727
Descriptionlogger.c in the logger plugin in WeeChat before 1.9.1 allows a crash via strftime date/time specifiers, because a buffer is not initialized.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
ReferencesDLA-1111-1
Debian Bugs876553

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
weechat (PTS)buster2.3-1+deb10u1fixed
bullseye3.0-1+deb11u1fixed
bookworm3.8-1fixed
sid, trixie4.1.1-1fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
weechatsourcewheezy0.3.8-1+deb7u3DLA-1111-1
weechatsourcejessie1.0.1-1+deb8u2
weechatsourcestretch1.6-1+deb9u2
weechatsource(unstable)1.9.1-1876553

Notes

Fixed by: https://github.com/weechat/weechat/commit/f105c6f0b56fb5687b2d2aedf37cb1d1b434d556

Search for package or bug name: Reporting problems