CVE-2024-46613
Publication date 10 November 2024
Last updated 11 July 2025
Ubuntu priority
Description
WeeChat before 4.4.2 has an integer overflow and resultant buffer overflow at core/core-string.c when there are more than two billion items in a list. This affects string_free_split_shared , string_free_split, string_free_split_command, and string_free_split_tags.
Status
| Package | Ubuntu Release | Status |
|---|---|---|
| weechat | 26.04 LTS resolute |
Not affected
|
| 25.10 questing |
Not affected
|
|
| 24.04 LTS noble |
Needs evaluation
|
|
| 22.04 LTS jammy |
Needs evaluation
|
|
| 20.04 LTS focal | Ignored end of standard support, was needs-triage | |
| 18.04 LTS bionic |
Needs evaluation
|
|
| 16.04 LTS xenial |
Needs evaluation
|
Severity score breakdown
| Parameter | Value |
|---|---|
| Base score |
4.3 · Medium
|
| Attack vector | Physical |
| Attack complexity | Low |
| Privileges required | None |
| User interaction | None |
| Scope | Unchanged |
| Confidentiality | Low |
| Integrity impact | Low |
| Availability impact | Low |
| Vector | CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L |
References
Other references
- https://www.cve.org/CVERecord?id=CVE-2024-46613
- https://weechat.org/doc/weechat/security/WSA-2024-1/
- https://github.com/weechat/weechat/issues/2178
- https://github.com/weechat/weechat/commit/315f769ab25643cf501a4bf8deb8025d92654303
- https://github.com/weechat/weechat/commit/5564baf424d847144f13ee50f0988e4f3407e638
- https://github.com/weechat/weechat/commit/62d0347d4bdee63694354184611b0b6af5028ff2
- https://github.com/weechat/weechat/commit/970f20af31cbcce02a99368eb633e8c4082dfe64
- https://github.com/weechat/weechat/commit/9aa0a94156c7cc367d52c31e60d8b03239d4dbd4