[SECURITY] [DSA 2598-1] weechat security update

2013-01-0512:40:11

lists.debian.org

7.5 High

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

0.015 Low

EPSS

Percentile

86.6%

JSON

Debian Security Advisory DSA-2598-1 [email protected]
http://www.debian.org/security/ Moritz Muehlenhoff
January 05, 2013 http://www.debian.org/security/faq

Package : weechat
Vulnerability : several
Problem type : remote
Debian-specific: no
CVE ID : CVE-2011-1428 CVE-2012-5534

Two security issues have been discovered in Weechat a, fast, light and
extensible chat client:

CVE-2011-1428

X.509 certificates were incorrectly validated.

CVE-2012-5534

The hook_process function in the plugin API allowed the execution
of arbitrary shell commands.

For the stable distribution (squeeze), these problems have been fixed in
version 0.3.2-1+squeeze1.

For the testing distribution (wheezy), these problems have been fixed in
version 0.3.8-1+deb7u1.

For the unstable distribution (sid), these problems have been fixed in
version 0.3.9.2-1.

We recommend that you upgrade your weechat packages.

Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: http://www.debian.org/security/

Mailing list: [email protected]

OSVersionArchitecturePackageVersionFilename
Debian7amd64weechat-plugins< 0.3.8-1+deb7u1weechat-plugins_0.3.8-1+deb7u1_amd64.deb
Debian7amd64weechat-curses< 0.3.8-1+deb7u1weechat-curses_0.3.8-1+deb7u1_amd64.deb
Debian6s390weechat-plugins< 0.3.2-1+squeeze1weechat-plugins_0.3.2-1+squeeze1_s390.deb
Debian6amd64weechat-dbg< 0.3.2-1+squeeze1weechat-dbg_0.3.2-1+squeeze1_amd64.deb
Debian6powerpcweechat-core< 0.3.2-1+squeeze1weechat-core_0.3.2-1+squeeze1_powerpc.deb
Debian7s390xweechat-plugins< 0.3.8-1+deb7u1weechat-plugins_0.3.8-1+deb7u1_s390x.deb
Debian7kfreebsd-amd64weechat-core< 0.3.8-1+deb7u1weechat-core_0.3.8-1+deb7u1_kfreebsd-amd64.deb
Debian6mipselweechat-plugins< 0.3.2-1+squeeze1weechat-plugins_0.3.2-1+squeeze1_mipsel.deb
Debian6sparcweechat-plugins< 0.3.2-1+squeeze1weechat-plugins_0.3.2-1+squeeze1_sparc.deb
Debian7mipsweechat-core< 0.3.8-1+deb7u1weechat-core_0.3.8-1+deb7u1_mips.deb

OS	Version	Architecture	Package	Version	Filename
Debian	7	amd64	weechat-plugins	< 0.3.8-1+deb7u1	weechat-plugins_0.3.8-1+deb7u1_amd64.deb
Debian	7	amd64	weechat-curses	< 0.3.8-1+deb7u1	weechat-curses_0.3.8-1+deb7u1_amd64.deb
Debian	6	s390	weechat-plugins	< 0.3.2-1+squeeze1	weechat-plugins_0.3.2-1+squeeze1_s390.deb
Debian	6	amd64	weechat-dbg	< 0.3.2-1+squeeze1	weechat-dbg_0.3.2-1+squeeze1_amd64.deb
Debian	6	powerpc	weechat-core	< 0.3.2-1+squeeze1	weechat-core_0.3.2-1+squeeze1_powerpc.deb
Debian	7	s390x	weechat-plugins	< 0.3.8-1+deb7u1	weechat-plugins_0.3.8-1+deb7u1_s390x.deb
Debian	7	kfreebsd-amd64	weechat-core	< 0.3.8-1+deb7u1	weechat-core_0.3.8-1+deb7u1_kfreebsd-amd64.deb
Debian	6	mipsel	weechat-plugins	< 0.3.2-1+squeeze1	weechat-plugins_0.3.2-1+squeeze1_mipsel.deb
Debian	6	sparc	weechat-plugins	< 0.3.2-1+squeeze1	weechat-plugins_0.3.2-1+squeeze1_sparc.deb
Debian	7	mips	weechat-core	< 0.3.8-1+deb7u1	weechat-core_0.3.8-1+deb7u1_mips.deb