CVE-2011-1428: flashtux weechat Improper Input Validation
Vulnerability summary
CVE-2011-1428 is a medium (CVSS 5.8) Improper Input Validation vulnerability in flashtux weechat. EPSS estimates a 1.08% chance of exploitation in the next 30 days, higher than 64.8% of scored vulnerabilities. 2 public exploits are recorded.
Advisory lineage
Upstream 0 · Downstream 1Timeline
- 16-03-2011PublishedVulnerability first disclosed.
- 17-09-2024Last modifiedVulnerability information updated.
Description
Wee Enhanced Environment for Chat (aka WeeChat) 0.3.4 and earlier does not properly verify that the server hostname matches the domain name of the subject of an X.509 certificate, which allows man-in-the-middle attackers to spoof an SSL chat server via an arbitrary certificate, related to incorrect use of the GnuTLS API.
CVSS metrics
1 score · 1 source · 1 versionEPSS trend
Probability
1.08%
Chance of exploitation in the next 30 days
Percentile
65%
Versus all other CVEs
30-day change
0.00 pp
From 1.08% on 21-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
2 foundExploit Reference (savannah.nongnu.org)
Maturity: unknown
Exploit Reference (archives.neohapsis.com)
Maturity: unknown
Weaknesses
CWE · root causeAffected systems
Debian1 product
- weechat< 0.3.5-1
Flashtux1 product
- weechat≤ 0.3.4 | 0.0.1 | 0.0.2 | 0.0.3 | 0.0.4 | 0.0.5 | 0.0.6 | 0.0.7 | 0.0.8 | 0.0.9 | 0.1.0 | 0.1.1 | 0.1.2 | 0.1.3 | 0.1.4 | 0.1.5 | 0.1.6 | 0.1.7 | 0.1.8 | 0.1.9 | 0.2.0 | 0.2.1 | 0.2.2 | 0.2.3 | 0.2.4 | 0.2.5 | 0.2.6 | 0.2.6.1 | 0.2.6.2 | 0.2.6.3 | 0.3.0 | 0.3.1 | 0.3.1.1 | 0.3.2 | 0.3.3
Ubuntu1 product
- weechat< 0.4.2-3ubuntu0.1 | < 1.4-2ubuntu0.1
3 vendors · 3 products
References
8 links- archives.neohapsis.com/archives/fulldisclosure/2011-02/0671.htmlMailing ListX Refsource FULLDISCExploit
