CVE-2009-4016

Integer underflow in the clean_string function in irc_string.c in (1) IRCD-hybrid 7.2.2 and 7.2.3, (2) ircd-ratbox before 2.2.9, and (3) oftc-hybrid before 1.6.8, when flatten_links is disabled, allows remote attackers to execute arbitrary code or cause a denial of service (daemon crash) via a LINKS command.

• CWE-189

• http://lists.ratbox.org/pipermail/ircd-ratbox/2010-January/000891.html
• http://secunia.com/advisories/38210Vendor Advisory
• http://secunia.com/advisories/38381Vendor Advisory
• http://secunia.com/advisories/38382Vendor Advisory
• http://secunia.com/advisories/38383Vendor Advisory
• http://security.debian.org/pool/updates/main/i/ircd-hybrid/ircd-hybrid_7.2.2.dfsg.2-4+lenny1.diff.gzPatch
• http://svn.ircd-hybrid.org:8000/viewcvs.cgi?rev=1044&view=rev
• http://trac.oftc.net/projects/oftc-hybrid/browser/tags/oftc-hybrid-1.6.8/RELNOTES
• http://www.debian.org/security/2010/dsa-1980Patch
• http://www.securityfocus.com/bid/37978
• http://lists.ratbox.org/pipermail/ircd-ratbox/2010-January/000891.html
• http://secunia.com/advisories/38210Vendor Advisory
• http://secunia.com/advisories/38381Vendor Advisory
• http://secunia.com/advisories/38382Vendor Advisory
• http://secunia.com/advisories/38383Vendor Advisory
• http://security.debian.org/pool/updates/main/i/ircd-hybrid/ircd-hybrid_7.2.2.dfsg.2-4+lenny1.diff.gzPatch
• http://svn.ircd-hybrid.org:8000/viewcvs.cgi?rev=1044&view=rev
• http://trac.oftc.net/projects/oftc-hybrid/browser/tags/oftc-hybrid-1.6.8/RELNOTES
• http://www.debian.org/security/2010/dsa-1980Patch
• http://www.securityfocus.com/bid/37978

Published

Feb 4, 2010

Last Modified

Jun 16, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2009-4010Unspecified vulnerability in PowerDNS Recursor before 3.1.7.…
• CVE-2009-4011dtc-xen 0.5.x before 0.5.4 suffers from a race condition whe…8.1
• CVE-2009-4012Multiple integer overflows in LibThai before 0.1.13 might al…
• CVE-2009-4013Multiple directory traversal vulnerabilities in Lintian 1.23…9.8
• CVE-2009-4014Multiple format string vulnerabilities in Lintian 1.23.x thr…
• CVE-2009-4015Lintian 1.23.x through 1.23.28, 1.24.x through 1.24.2.1, and…
• CVE-2009-4017PHP before 5.2.12 and 5.3.x before 5.3.1 does not restrict t…
• CVE-2009-4018The proc_open function in ext/standard/proc_open.c in PHP be…
• CVE-2009-4019mysqld in MySQL 5.0.x before 5.0.88 and 5.1.x before 5.1.41 …
• CVE-2009-4020Stack-based buffer overflow in the hfs subsystem in the Linu…
• CVE-2009-4021The fuse_direct_io function in fs/fuse/file.c in the fuse su…
• CVE-2009-4022Unspecified vulnerability in ISC BIND 9.0.x through 9.3.x, 9…