Vulnerability in Libpoe-component-irc-perl
CVE-2010-3438
libpoe-component-irc-perl before v6.32 does not remove carriage returns and line feeds. This can be used to execute arbitrary IRC commands by passing an argument such as "some text\rQUIT" to the 'privmsg' handler, which would cause the cli…
EPSS: 0.017 (73.6th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 9.8 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.
Affected products
- Libpoe-component-irc-perl — versions before v6.32
- Libpoe-component-irc-perl_project Libpoe-component-irc-perl
- Debian Debian_linux — versions 8.0, 9.0, 10.0
- Fedoraproject Fedora — versions 12, 13
Weakness classification (CWE)
References
- secalert@redhat.com (Third Party Advisory, x_refsource_MISC)
- secalert@redhat.com (Patch, Third Party Advisory, x_refsource_MISC, Issue Tracking)
- secalert@redhat.com (Patch, Mailing List, Third Party Advisory, x_refsource_MISC)
Frequently asked questions
- What is CVE-2010-3438?
- CVE-2010-3438 is a critical-severity vulnerability in Libpoe-component-irc-perl, classified under Use of Externally-Controlled Format String. CVSS score: 9.8/10. Published 2019-11-12.
- How severe is CVE-2010-3438?
- Critical severity. CVSS v3 base score is 9.8 out of 10.