CVE-2017-8073

Publication date 23 April 2017

Last updated 25 August 2025

Ubuntu priority

Cvss 3 Severity Score

Description

WeeChat before 1.7.1 allows a remote crash by sending a filename via DCC to the IRC plugin. This occurs in the irc_ctcp_dcc_filename_without_quotes function during quote removal, with a buffer overflow.

Status

Show unmaintained releases

Package	Ubuntu Release	Status
weechat	17.04 zesty	Fixed 1.7-2ubuntu0.1
	16.10 yakkety	Fixed 1.5-1ubuntu0.1
	16.04 LTS xenial	Fixed 1.4-2ubuntu0.1
	14.04 LTS trusty	Fixed 0.4.2-3ubuntu0.1
	12.04 LTS precise	Ignored end of life

How can I get the fixes?
What do statuses mean?

Severity score breakdown

Parameter	Value
Base score	7.5 · High
Attack vector	Network
Attack complexity	Low
Privileges required	None
User interaction	None
Scope	Unchanged
Confidentiality	None
Integrity impact	None
Availability impact	High
Vector	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References

MITRE
NVD
Launchpad
Debian

Other references

https://github.com/weechat/weechat/commit/2fb346f25f79e412cf0ed314fdf791763c19b70b
https://weechat.org/download/security/
https://weechat.org/news/95/20170422-Version-1.7.1/
https://www.cve.org/CVERecord?id=CVE-2017-8073