Weekly edition	Kernel	Security	Distributions	Contact Us	Search
Archives	Calendar	Subscribe	Write for LWN	LWN.net FAQ	Sponsors

kvirc: remote arbitrary code execution

Package(s):

kvirc

CVE #(s):

CVE-2007-2951

Created:

September 14, 2007

Updated:

February 27, 2008

Description:

Stefan Cornelius from Secunia Research discovered that the "parseIrcUrl()" function in file src/kvirc/kernel/kvi_ircurl.cpp does not properly sanitize parts of the URI when building the command for KVIrc's internal script system.

Alerts:

SuSE	SUSE-SR:2007:015	2007-08-03
Gentoo	200709-02	2007-09-13

(Log in to post comments)