[Secure-testing-team] Bug#852275: hexchat: CVE-2016-2087

[Salvatore Bonaccorso]

Source: hexchat
Version: 2.10.1-1
Severity: important
Tags: security

Hi,

the following vulnerability was published for hexchat. Opening a bug
to have a BTS reference.

CVE-2016-2087[0]:
| Directory traversal vulnerability in the client in HexChat 2.11.0
| allows remote IRC servers to read or modify arbitrary files via a ..
| (dot dot) in the server name.

As noted by Mattia Rizzolo already, the fixing commit is reverted in
the Debian packaging due to regression for some usecases, and waiting
for a better fix.

If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2016-2087
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2087

Regards,
Salvatore