When a znc web administrator tried to add a channel, which already existed, via web admin interface, it would cause a crash if the channel name isn't prefixed with '#' (i.e you already have a channel '#potato' but you try to add 'potato' without the '#' prefix). This only appears to happen if the channel is already in the list and not if you are adding a new channel that isn't already in the list. References: Upstream bug: https://github.com/znc/znc/issues/528 Commit: https://github.com/znc/znc/commit/5e6e3be32acfeadeaf1fb3bb17bada08aec6432f
This security flaw has already been addressed in Fedora and EPEL via the following security advisories: https://admin.fedoraproject.org/updates/FEDORA-2014-5214/znc-1.2-3.fc19 https://admin.fedoraproject.org/updates/FEDORA-2014-5254/znc-1.2-3.fc20 https://admin.fedoraproject.org/updates/FEDORA-EPEL-2014-1137/znc-1.2-3.el6 https://admin.fedoraproject.org/updates/FEDORA-EPEL-2014-1119/znc-1.2-3.el5 Currently Fedora-19, Fedora-20, EPEL-5, EPEL-6 and EPEL-7 contain znc-1.4, which also contains a fix for this issue.