Ubuntu Security Notices
USN-6990-1

USN-6990-1: znc vulnerability

Publication date

4 September 2024

Overview

znc could be made to execute arbitrary code on a user’s system if they were persuaded to join a malicious server.

Releases

24.04 LTS 22.04 LTS 20.04 LTS 18.04 LTS 16.04 LTS 14.04 LTS

Packages

znc - advanced modular IRC bouncer

Details

Johannes Kuhn (DasBrain) discovered that znc incorrectly handled
user input under certain operations. An attacker could possibly
use this issue to execute arbitrary code on a user’s system if
the user was tricked into joining a malicious server.

Update instructions

In general, a standard system update will make all the necessary changes.

Learn more about how to get the fixes.

The problem can be corrected by updating your system to the following package versions:

Ubuntu Release	Package Version
24.04 noble	znc – 1.9.0-2ubuntu0.1~esm2
	znc-dev – 1.9.0-2ubuntu0.1~esm2
	znc-perl – 1.9.0-2ubuntu0.1~esm2
	znc-python – 1.9.0-2ubuntu0.1~esm2
	znc-tcl – 1.9.0-2ubuntu0.1~esm2
22.04 jammy	znc – 1.8.2-2ubuntu0.1
	znc-dev – 1.8.2-2ubuntu0.1
	znc-perl – 1.8.2-2ubuntu0.1
	znc-python – 1.8.2-2ubuntu0.1
	znc-tcl – 1.8.2-2ubuntu0.1
20.04 focal	znc – 1.7.5-4ubuntu0.1~esm2
	znc-dev – 1.7.5-4ubuntu0.1~esm2
	znc-perl – 1.7.5-4ubuntu0.1~esm2
	znc-python – 1.7.5-4ubuntu0.1~esm2
	znc-tcl – 1.7.5-4ubuntu0.1~esm2
18.04 bionic	znc – 1.6.6-1ubuntu0.2+esm2
	znc-dev – 1.6.6-1ubuntu0.2+esm2
	znc-perl – 1.6.6-1ubuntu0.2+esm2
	znc-python – 1.6.6-1ubuntu0.2+esm2
	znc-tcl – 1.6.6-1ubuntu0.2+esm2
16.04 xenial	znc – 1.6.3-1ubuntu0.2+esm2
	znc-dev – 1.6.3-1ubuntu0.2+esm2
	znc-perl – 1.6.3-1ubuntu0.2+esm2
	znc-python – 1.6.3-1ubuntu0.2+esm2
	znc-tcl – 1.6.3-1ubuntu0.2+esm2
14.04 trusty	znc – 1.2-3ubuntu0.1+esm3
	znc-dev – 1.2-3ubuntu0.1+esm3
	znc-perl – 1.2-3ubuntu0.1+esm3
	znc-python – 1.2-3ubuntu0.1+esm3
	znc-tcl – 1.2-3ubuntu0.1+esm3

Reduce your security exposure

Ubuntu Pro provides ten-year security coverage to 25,000+ packages in Main and Universe repositories, and it is free for up to five machines.

Get Ubuntu Pro

References

CVE-2024-39844

CVE-2024-39844