CVE-2007-4398 Multiple CRLF injection vulnerabilities in the (1) now-playing.rb and (2) xmms.pl 1.1 scripts for WeeChat allow user-assisted remote attackers to execute arbitrary IRC commands via CRLF sequences in t...
MediumCVSS 6.8
EPSS 1.8%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Multiple CRLF injection vulnerabilities in the (1) now-playing.rb and (2) xmms.pl 1.1 scripts for WeeChat allow user-assisted remote attackers to execute arbitrary IRC commands via CRLF sequences in the name of the song in a .mp3 file.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| irssi | <= 0.8.10rc5 | No fix listed |
| debian/irssi-scripts(Debian:12) | < 20070925 | 20070925 |
| debian/irssi-scripts(Debian:13) | < 20070925 | 20070925 |
| debian/irssi-scripts(Debian:14) | < 20070925 | 20070925 |
| debian/weechat-scripts(Debian:12) | < 20070425-0.1 | 20070425-0.1 |
| debian/weechat-scripts(Debian:13) | < 20070425-0.1 | 20070425-0.1 |
| debian/weechat-scripts(Debian:14) | < 20070425-0.1 | 20070425-0.1 |
References
- git.sv.gnu.org
- git.sv.gnu.org
- 20070812 Vulnerability in multiple "now playing" scripts for various IRC clients mailing-list
- 39564 vdb-entry
- 39565 vdb-entry
- 26457 third-party-advisory vendor-advisory
- 26490 third-party-advisory vendor-advisory
- 3036 third-party-advisory
- wouter.coekaerts.be
- 20070812 Vulnerability in multiple "now playing" scripts for various IRC clients mailing-list
- 25281 vdb-entry
- irc-multiple-command-execution(35985) vdb-entry
- Debian Security Tracker CVE-2007-4398 vendor-advisory
- bugs.debian.org issue-tracking
- bugs.debian.org issue-tracking