CVEvulnerability
CVE-2010-3438
9.8 CRITICAL
Official page ↗
- Status
- Modified
- Published
- 2019-11-12
- Last modified
- 2026-06-16
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 9.8 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- CVSS 2.0 ([email protected])
- 7.5 HIGH — AV:N/AC:L/Au:N/C:P/I:P/A:P
- Weaknesses
- CWE-134
Description
libpoe-component-irc-perl before v6.32 does not remove carriage returns and line feeds. This can be used to execute arbitrary IRC commands by passing an argument such as "some text\rQUIT" to the 'privmsg' handler, which would cause the client to disconnect from the server.
Affected configurations
• libpoe-component-irc-perl project libpoe-component-irc-perl (< 6.32)
• debian debian linux 8.0
• debian debian linux 9.0
• debian debian linux 10.0
• fedoraproject fedora 12
• fedoraproject fedora 13
Related
Weakness · CWE (1)
- CWE-134 Use of Externally-Controlled Format String weakness
References
- https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=581194 Mailing List, Patch, Third Party Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2010-3438 Issue Tracking, Patch, Third Party Advisory
- https://security-tracker.debian.org/tracker/CVE-2010-3438 Third Party Advisory
- https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=581194 Mailing List, Patch, Third Party Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2010-3438 Issue Tracking, Patch, Third Party Advisory
- https://security-tracker.debian.org/tracker/CVE-2010-3438 Third Party Advisory