Bug 1414689 (CVE-2016-2087, CVE-2016-2233)

Summary:	CVE-2016-2087 CVE-2016-2233 hexchat: Multiple vulnerabilities
Product:	[Other] Security Response	Reporter:	Andrej Nemec <anemec>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	oliver, praiskup, tingping
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2021-10-21 11:51:15 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1414690
Bug Blocks:

Description Andrej Nemec 2017-01-19 09:14:54 UTC

Two vulnerabilities were found in hexchat 2.11.0 and before.

CVE-2016-2087:

Directory traversal vulnerability in the client in HexChat 2.11.0 allows remote IRC servers to read or modify arbitrary files via a .. (dot dot) in the server name.

CVE-2016-2233:

Stack-based buffer overflow in the inbound_cap_ls function in common/inbound.c in HexChat 2.10.2 allows remote IRC servers to cause a denial of service (crash) via a large number of options in a CAP LS message.

References:

https://www.exploit-db.com/exploits/39657/
https://www.exploit-db.com/exploits/39656/

Comment 1 Andrej Nemec 2017-01-19 09:15:16 UTC

Created hexchat tracking bugs for this issue:

Affects: epel-6 [bug 1414690]

Comment 2 Agostino Sarubbo 2017-01-20 11:18:16 UTC

For the record:

CVE-2016-2087 is fixed since 2.12.2
https://github.com/hexchat/hexchat/commit/15600f405f2d5bda6ccf0dd73957395716e0d4d3

CVE-2016-2233 is fixed since 2.12.0
https://github.com/hexchat/hexchat/commit/4e061a43b3453a9856d34250c3913175c45afe9d