Bugzilla – Bug 956254
VUL-0: CVE-2014-9403 znc: Crash while adding channels to the web admin
Last modified: 2018-07-18 08:30:19 UTC
The CWebAdminMod::ChanPage function in modules/webadmin.cpp in ZNC before 1.4 allows remote authenticated users to cause a denial of service (NULL pointer dereference and crash) by adding a channel with the same name as an existing channel but without the leading # character, related to a "use-after-delete" error. http://wiki.znc.in/ChangeLog/1.6.2 Fixed a use-after-delete in webadmin. It was already partially fixed in ZNC 1.4; since 1.4 it has been still possible to trigger, but much harder. (#528) Details: https://github.com/znc/znc/issues/528 Partial fix in 1.4, complete fix in 1.6.2. Affects openSUSE Leap 42.1 and SLE 12 Backports. Submission is in, adding tracking for completeness. Maintainer, please submit again with this bug number and CVE. References: https://bugzilla.redhat.com/show_bug.cgi?id=1177580 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-9403 http://www.openwall.com/lists/oss-security/2014/12/18/2 http://people.canonical.com/~ubuntu-security/cve/2014/CVE-2014-9403.html http://www.cvedetails.com/cve/CVE-2014-9403/ http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-9403 http://secunia.com/advisories/57795 http://www.securityfocus.com/bid/66926 http://advisories.mageia.org/MGASA-2014-0543.html https://github.com/znc/znc/issues/528 https://github.com/znc/znc/blob/master/ChangeLog.md
This is an autogenerated message for OBS integration: This bug (956254) was mentioned in https://build.opensuse.org/request/show/345868 Backports:SLE-12+42.1 / znc+znc.openSUSE_Backports_SLE-12
Thanks, update is running
releasing
openSUSE-SU-2015:2163-1: An update that fixes one vulnerability is now available. Category: security (low) Bug References: 956254 CVE References: CVE-2014-9403 Sources used: SUSE Package Hub for SUSE Linux Enterprise 12 (src): znc-1.6.2-9.1
openSUSE-SU-2015:2164-1: An update that fixes one vulnerability is now available. Category: security (low) Bug References: 956254 CVE References: CVE-2014-9403 Sources used: openSUSE Leap 42.1 (src): znc-1.6.2-8.1
This is an autogenerated message for OBS integration: This bug (956254) was mentioned in https://build.opensuse.org/request/show/623128 15.0+42.3+Backports:SLE-12-SP2 / znc
This is an autogenerated message for OBS integration: This bug (956254) was mentioned in https://build.opensuse.org/request/show/623568 15.0+42.3+Backports:SLE-12-SP2 / znc