A vulnerability has been found in ZNC which could result in remote code execution.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| net-irc/znc | * | < 1.9.1 | >= 1.9.1 |
ZNC is an advanced IRC bouncer.
ZNC's modtcl could allow for remote code execution via a KICK.
A vulnerable ZNC with the modtcl module loaded could be exploited for remote code execution.
Unload the mod_tcl module.
All ZNC users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=net-irc/znc-1.9.1"
A vulnerability in ZNC allows users to escalate privileges.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| net-irc/znc | * | < 1.7.4_rc1 | >= 1.7.4_rc1 |
ZNC is an advanced IRC bouncer.
It was discovered that ZNC’s “Modules.cpp” allows remote authenticated non-admin users to escalate privileges.
A remote authenticated attacker could escalate privileges and subsequently execute arbitrary code or conduct a Denial of Service attack.
There is no known workaround at this time.
All ZNC users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=net-irc/znc-1.7.4_rc1"
Multiple vulnerabilities have been found in ZNC, the worst of which could result in privilege escalation.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| net-irc/znc | * | < 1.7.1 | >= 1.7.1 |
ZNC is an advanced IRC bouncer.
Multiple vulnerabilities have been discovered in ZNC. Please review the CVE identifiers referenced below for details.
A remote attacker could read arbitary files and esclate privileges.
There is no known workaround at this time.
All ZNC users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=net-irc/znc-1.7.1"
Multiple vulnerabilities in ZNC could lead to Denial of Service.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| net-irc/znc | * | < 1.2-r1 | >= 1.2-r1 |
ZNC is an advanced IRC bouncer.
Multiple NULL pointer dereferences have been found in ZNC.
A remote attacker could send a specially crafted request, possibly resulting in a Denial of Service condition.
There is no known workaround at this time.
All ZNC users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=net-irc/znc-1.2-r1"
A directory traversal was found in ZNC, allowing for overwriting of arbitrary files.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| net-irc/znc | * | < 0.074 | >= 0.074 |
ZNC is an advanced IRC bouncer.
The vendor reported a directory traversal vulnerability when processing DCC SEND requests.
A remote, authenticated user could send a specially crafted DCC SEND request to overwrite arbitrary files with the privileges of the user running ZNC, and possibly cause the execution of arbitrary code e.g. by uploading a malicious ZNC module.
There is no known workaround at this time.
All ZNC users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=net-irc/znc-0.074"
A vulnerability in ZNC allows for privilege escalation.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| net-irc/znc | * | < 0.066 | >= 0.066 |
ZNC is an advanced IRC bouncer.
cnu discovered multiple CRLF injection vulnerabilities in ZNC's webadmin module.
A remote authenticated attacker could modify the znc.conf configuration file and gain privileges via newline characters in e.g. the QuitMessage field, and possibly execute arbitrary code.
There is no known workaround at this time.
All ZNC users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=net-irc/znc-0.066"