What’s Vulnerable › Vulnerabilities

CVE-2017-8073

• Severity: high (CVSS 7.5 v3.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 3.1% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2017-04-23 · updated 2026-06-17
• Weakness: CWE-119

Description

WeeChat before 1.7.1 allows a remote crash by sending a filename via DCC to the IRC plugin. This occurs in the irc_ctcp_dcc_filename_without_quotes function during quote removal, with a buffer overflow.

Affected products

• Debian Linux: 8.0
• weechat: before 1.7.1 — fixed in 1.7.1

How to fix

Upgrade to a fixed version: weechat 1.7.1. Check the vendor advisory for mitigations.

References

• http://www.debian.org/security/2017/dsa-3836
• http://www.securityfocus.com/bid/97987
• https://github.com/weechat/weechat/commit/2fb346f25f79e412cf0ed314fdf791763c19b70b
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4ASRTCQFFDAAK347URWNDH6NSED2BGNY/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ER23GT23US5JXDLUZAMGMWXKZ74MI4S2/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/M3LAJTLI3LWZRNCFYJ7PCBBTHUMCCBHH/
• https://weechat.org/download/security/
• https://weechat.org/news/95/20170422-Version-1.7.1/
• http://www.debian.org/security/2017/dsa-3836
• http://www.securityfocus.com/bid/97987
• https://github.com/weechat/weechat/commit/2fb346f25f79e412cf0ed314fdf791763c19b70b
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4ASRTCQFFDAAK347URWNDH6NSED2BGNY/

Get alerted when CVE-2017-8073 or the next vulnerability affects your stack