CVE-2017-14727
UnknownEPSS 2.84%
Last modified
CVE-2017-14727 is a vulnerability of currently unknown severity. logger.c in the logger plugin in WeeChat before 1.9.1 allows a crash via strftime date/time specifiers, because a buffer is not initialized.. EPSS estimates a 2.84% chance of exploitation in the next 30 days.
Description
logger.c in the logger plugin in WeeChat before 1.9.1 allows a crash via strftime date/time specifiers, because a buffer is not initialized.
Metrics
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Weechat | Logger | All versions |
References
- http://www.securityfocus.com/bid/101003Third Party Advisory, VDB Entry
- https://github.com/weechat/weechat/commit/f105c6f0b56fb5687b2d2aedf37cb1d1b434d556Patch, Third Party Advisory
- https://weechat.org/download/security/Vendor Advisory
- https://weechat.org/news/98/20170923-Version-1.9.1-security-release/Release Notes, Vendor Advisory
- http://www.securityfocus.com/bid/101003Third Party Advisory, VDB Entry
- https://github.com/weechat/weechat/commit/f105c6f0b56fb5687b2d2aedf37cb1d1b434d556Patch, Third Party Advisory
- https://weechat.org/download/security/Vendor Advisory
- https://weechat.org/news/98/20170923-Version-1.9.1-security-release/Release Notes, Vendor Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2017-14727?
logger.c in the logger plugin in WeeChat before 1.9.1 allows a crash via strftime date/time specifiers, because a buffer is not initialized.
How severe is CVE-2017-14727?
Severity scoring for CVE-2017-14727 is pending analysis. The EPSS model estimates a 2.84% probability of exploitation in the next 30 days.
How do I fix CVE-2017-14727?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2017
- CVE-2017-14721Before version 4.8.2, WordPress allowed Cross-Site scripting…
- CVE-2017-14722Before version 4.8.2, WordPress allowed a Directory Traversa…
- CVE-2017-14723Before version 4.8.2, WordPress mishandled % characters and …
- CVE-2017-14724Before version 4.8.2, WordPress was vulnerable to cross-site…
- CVE-2017-14725Before version 4.8.2, WordPress was susceptible to an open r…
- CVE-2017-14726Before version 4.8.2, WordPress was vulnerable to a cross-si…
- CVE-2017-14728An authentication bypass was found in an unknown area of the…9.8
- CVE-2017-14729The *_get_synthetic_symtab functions in the Binary File Desc…
- CVE-2017-1473IBM Security Access Manager Appliance 8.0.0 through 8.0.1.6 …
- CVE-2017-14730The init script in the Gentoo app-admin/logstash-bin package…
- CVE-2017-14731ofx_proc_file in ofx_preproc.cpp in LibOFX 0.9.12 allows rem…
- CVE-2017-14733ReadRLEImage in coders/rle.c in GraphicsMagick 1.3.26 mishan…
Are you affected by CVE-2017-14727?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST