CVSS2
Attack Vector
NETWORK
Attack Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
COMPLETE
Integrity Impact
COMPLETE
Availability Impact
COMPLETE
AV:N/AC:M/Au:N/C:C/I:C/A:C
EPSS
Percentile
91.1%
KVIrc is a free portable IRC client based on Qt.
Stefan Cornelius from Secunia Research discovered that the “parseIrcUrl()” function in file src/kvirc/kernel/kvi_ircurl.cpp does not properly sanitise parts of the URI when building the command for KVIrc’s internal script system.
A remote attacker could entice a user to open a specially crafted irc:// URI, possibly leading to the remote execution of arbitrary code with the privileges of the user running KVIrc. Successful exploitation requires that KVIrc is registered as the default handler for irc:// or similar URIs.
There is no known workaround at this time.
All KVIrc users should upgrade to the latest version:
# emerge --sync
# emerge --ask --oneshot --verbose ">=net-irc/kvirc-3.2.6_pre20070714"
OS | Version | Architecture | Package | Version | Filename |
---|---|---|---|---|---|
Gentoo | any | all | net-irc/kvirc | < 3.2.6_pre20070714 | UNKNOWN |