PatchTheCVEznc vulnerabilities and fixes
Recent CVEs affecting znc, with upgrade or downgrade steps. 8 tracked.
znc has 8 tracked vulnerabilities, 0 critical. A fixed release or vendor patch exists for 6. Most recent: 2020-06-02. Highest priority: CVE-2010-2488 (score 57/100).
- CVE-2020-13775 MEDIUM 6.5 DOWNGRADE MITIGATE ZNC 1.8.0 up to 1.8.1-rc1 allows authenticated users to trigger an application crash (with a NULL pointer dere
- CVE-2019-9917 MEDIUM 6.5 UPGRADE MITIGATE ZNC before 1.7.3-rc1 allows an existing remote user to cause a Denial of Service (crash) via invalid encoding.
- CVE-2019-12816 HIGH 8.8 UPGRADE Modules.cpp in ZNC before 1.7.4-rc1 allows remote authenticated non-admin users to escalate privileges and exe
- CVE-2018-14056 MEDIUM 5.3 UPGRADE MITIGATE ZNC before 1.7.1-rc1 is prone to a path traversal flaw via ../ in a web skin name to access files outside of t
- CVE-2018-14055 MEDIUM 6.5 UPGRADE MITIGATE ZNC before 1.7.1-rc1 does not properly validate untrusted lines coming from the network, allowing a non-admin
- CVE-2014-9403 MEDIUM 4.0 UPGRADE The CWebAdminMod::ChanPage function in modules/webadmin.cpp in ZNC before 1.4 allows remote authenticated user
- CVE-2013-2130 MEDIUM 4.0 DOWNGRADE ZNC 1.0 allows remote authenticated users to cause a denial of service (NULL pointer reference and crash) via
- CVE-2010-2488 HIGH 7.5 UPGRADE NULL pointer dereference vulnerability in ZNC before 0.092 caused by traffic stats when there are unauthentica
FAQ
How do I fix znc vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is znc being exploited right now?
None of the tracked znc CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which znc CVE should I patch first?
CVE-2010-2488 currently ranks highest (57/100): NULL pointer dereference vulnerability in ZNC before 0.092 caused by traffic stats when there are unauthentica.