CVE-2021-40516

WeeChat before 3.2.1 allows remote attackers to cause a denial of service (crash) via a crafted WebSocket frame that trigger an out-of-bounds read in plugins/relay/relay-websocket.c in the Relay plugin.

WeeChat before 3.2.1 allows remote attackers to cause a denial of service (crash) via a crafted WebSocket frame that trigger an out-of-bounds read in plugins/relay/relay-websocket.c in the Relay plugin.

A crafted WebSocket frame could result in a crash in the weechat Relay plugin.

This update for weechat fixes the following issues:

update to 3.2.1:

• CVE-2021-40516: relay: fix crash when decoding a malformed websocket frame (boo#1190206)

update to 3.2

main changes:

• use XDG directories by default (config, data, cache, runtime)
• add support of IRC SASL mechanisms SCRAM-SHA-1, SCRAM-SHA-256 and SCRAM-SHA-512
• automatically load system certificates without giving a hardcoded path to the file with certificates
• add options to customize commands executed on system signals received (SIGHUP, SIGQUIT, SIGTERM, SIGUSR1, SIGUSR2)
• add bar item 'tls_version' and buflist format
• add signals 'cursor_start' and 'cursor_end'
• add function crypto_hmac in API
• add translated string in evaluation of expressions with 'translate:xxx'
• add info 'weechat_daemon'
• add Python stub for WeeChat API
• add variables '${tg_shell_argc}' and '${tg_shell_argvN}' in command trigger evaluated strings
• many bugs fixed.

for all changes, please visit: https://weechat.org/files/changelog/ChangeLog-3.2.html

update to 3.1

New features

• core: add options weechat.look.hotlist_update_on_buffer_switch and weechat.look.read_marker_update_on_buffer_switch (issue #992, issue #993)
• core: add option sec.crypt.passphrase_command to read passphrase from an external program on startup, remove option sec.crypt.passphrase_file (issue #141)
• core: improve debug in command /eval: display more verbose debug with two '-d', add indentation and colors
• core: add options 'setvar' and 'delvar' in command /buffer, rename option 'localvar' to 'listvar'
• core: add buffer local variable 'completion_default_template' (evaluated) to override the value of option 'weechat.completion.default_template' (issue #1600)
• core: add option 'recreate' in command /filter
• core: add raw string in evaluation of expressions with 'raw:xxx' (issue #1611)
• core: add evaluation of conditions in evaluation of expressions with 'eval_cond:xxx' (issue #1582)
• api: add info_hashtable 'secured_data'
• irc: add info 'irc_is_message_ignored'
• irc: add server option 'default_chantypes', used when the server does not send them in message 005 (issue #1610)
• trigger: add variable '${tg_trigger_name}' in command trigger evaluated strings (issue #1580)

• Bug fixes

  • core: fix quoted line in cursor mode (issue #1602)
  • core: fix wrong size of the new window after vertical split (issue #1612)
  • core: do not remove quotes in arguments of command /eval as they can be part of the evaluated expression/condition (issue #1601)
  • core: display an error when the buffer is not found with command /command -buffer
  • buflist: add option buflist.look.use_items to speed up display of buflist (issue #1613)
  • irc: add bar item 'irc_nick_prefix'
  • irc: fix separator between nick and host in bar item 'irc_nick_host'
  • irc: fix completion of commands /halfop and /dehalfop

• Documentation

  • do not build weechat-headless man page if headless binary is disabled (issue #1607)

update to 3.0.1:

• exec: fix search of command by identifier
• spell: fix refresh of bar item 'spell_suggest' when the input becomes empty (issue #1586)
• spell: fix crash with IRC color codes in command line (issue #1589)

update to 3.0

New features

• api: add optional list of colors in infos 'nick_color' and 'nick_color_name' (issue #1565)
• api: add argument 'bytes' in function string_dyn_concat
• api: add function string_color_code_size (issue #1547)
• exec: add option '-oerr' to send stderr to buffer (now disabled by default) (issue #1566)
• fset: add option fset.look.auto_refresh (issue #1553)
• irc: add pointer to irc_nick in focus of bar item 'buffer_nicklist' (issue #1535, issue #1538)
• irc: allow to send text on buffers with commands /allchan, /allpv and /allserv
• irc: evaluate command executed by commands /allchan, /allpv and /allserv (issue #1536)
• script: add…

Stuart Nevans Locke discovered that WeeChat's relay plugin insecurely handled malformed websocket frames. A remote attacker in control of a server could possibly use this issue to cause denial of service in a client. (CVE-2021-40516)

Stuart Nevans Locke discovered that WeeChat insecurely handled certain IRC messages. A remote attacker in control of a server could possibly use this issue to cause denial of service in a client. This issue only affected Ubuntu 16.04 ESM and Ubuntu 18.04 ESM. (CVE-2020-9760)

Stuart Nevans Locke discovered that WeeChat insecurely handled certain IRC messages. A remote unauthenticated attacker could possibly use these issues to cause denial of service in a client. These issues only affected Ubuntu 16.04 ESM and Ubuntu 18.04 ESM. (CVE-2020-9759, CVE-2020-8955)

Joseph Bisch discovered that WeeChat's logger incorrectly handled certain memory operations when handling log file names. A remote attacker could possibly use this issue to cause denial of service in a client. This issue only affected Ubuntu 16.04 ESM. (CVE-2017-14727)