CVE-2009-3163

Publication date 10 September 2009

Last updated 24 July 2024

Ubuntu priority

Medium

Why this priority?

Multiple format string vulnerabilities in lib/silcclient/command.c in Secure Internet Live Conferencing (SILC) Toolkit before 1.1.10, and SILC Client 1.1.8 and earlier, allow remote attackers to execute arbitrary code via format string specifiers in a channel name, related to (1) silc_client_command_topic, (2) silc_client_command_kick, (3) silc_client_command_leave, and (4) silc_client_command_users.

Read the notes from the security team

Status

No maintained releases are affected by this CVE.

Package Ubuntu Release Status
silc-client 9.10 karmic
Not affected
9.04 jaunty
Not affected
8.10 intrepid
Not affected
8.04 LTS hardy
Not affected
6.06 LTS dapper Not in release
silc-server 9.10 karmic
Not affected
9.04 jaunty
Not affected
8.10 intrepid
Not affected
8.04 LTS hardy
Not affected
6.06 LTS dapper Not in release
silc-toolkit 9.10 karmic
Not affected
9.04 jaunty Ignored
8.10 intrepid Ignored
8.04 LTS hardy Ignored
6.06 LTS dapper Ignored end of life

Notes

kees

Fortify-Source reduces this vulnerability to a DoS