Read the docs
TI-2013-05790 Aliases CVE-2013-7049GHSA-rj4x-5f2j-h52p

Stack-based buffer overflow in fish.cpp in the Fish plugin for ZNC, as used in ZNC for…

Priority LOW 23CWE-119Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
— Not recorded in CVSS 2.0
Attack complexity
Medium
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · Partial
Fix status
No fix listed

Attack profile from CVSS 2.0 · NVD. Fix status from CNA. Impact type from CWE-119 and the CVSS impact.

Summary

Stack-based buffer overflow in fish.cpp in the Fish plugin for ZNC, as used in ZNC for Windows (znc-msvc) 0.206 and earlier, allows remote attackers to cause a denial of service (crash) via a long string in a DH1080_INIT message.

Why it matters now

EPSS 0.01658 76th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 14

CPEVersionsRoleVendor
cpe:2.3:a:znc:znc-msvc:*:-:-:*:-:windows:*:*up to 0.206Vulnerableznc
cpe:2.3:a:znc:znc-msvc:0.076:-:-:*:-:windows:*:*0.076Vulnerableznc
cpe:2.3:a:znc:znc-msvc:0.077:-:-:*:-:windows:*:*0.077Vulnerableznc
cpe:2.3:a:znc:znc-msvc:0.078:-:-:*:-:windows:*:*0.078Vulnerableznc
cpe:2.3:a:znc:znc-msvc:0.079:-:-:*:-:windows:*:*0.079Vulnerableznc
cpe:2.3:a:znc:znc-msvc:0.080:-:-:*:-:windows:*:*0.080Vulnerableznc
cpe:2.3:a:znc:znc-msvc:0.089:-:-:*:-:windows:*:*0.089Vulnerableznc
cpe:2.3:a:znc:znc-msvc:0.090:-:-:*:-:windows:*:*0.090Vulnerableznc
cpe:2.3:a:znc:znc-msvc:0.093:-:-:*:-:windows:*:*0.093Vulnerableznc
cpe:2.3:a:znc:znc-msvc:0.094:-:-:*:-:windows:*:*0.094Vulnerableznc
  • cpe:2.3:a:znc:znc-msvc:*:-:-:*:-:windows:*:* Versions up to 0.206 Vulnerable ·znc
  • cpe:2.3:a:znc:znc-msvc:0.076:-:-:*:-:windows:*:* Versions 0.076 Vulnerable ·znc
  • cpe:2.3:a:znc:znc-msvc:0.077:-:-:*:-:windows:*:* Versions 0.077 Vulnerable ·znc
  • cpe:2.3:a:znc:znc-msvc:0.078:-:-:*:-:windows:*:* Versions 0.078 Vulnerable ·znc
  • cpe:2.3:a:znc:znc-msvc:0.079:-:-:*:-:windows:*:* Versions 0.079 Vulnerable ·znc
  • cpe:2.3:a:znc:znc-msvc:0.080:-:-:*:-:windows:*:* Versions 0.080 Vulnerable ·znc
  • cpe:2.3:a:znc:znc-msvc:0.089:-:-:*:-:windows:*:* Versions 0.089 Vulnerable ·znc
  • cpe:2.3:a:znc:znc-msvc:0.090:-:-:*:-:windows:*:* Versions 0.090 Vulnerable ·znc
  • cpe:2.3:a:znc:znc-msvc:0.093:-:-:*:-:windows:*:* Versions 0.093 Vulnerable ·znc
  • cpe:2.3:a:znc:znc-msvc:0.094:-:-:*:-:windows:*:* Versions 0.094 Vulnerable ·znc
Show 4 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:znc:znc-msvc:0.095:-:-:*:-:windows:*:*0.095Vulnerableznc
cpe:2.3:a:znc:znc-msvc:0.097:-:-:*:-:windows:*:*0.097Vulnerableznc
cpe:2.3:a:znc:znc-msvc:0.098:-:-:*:-:windows:*:*0.098Vulnerableznc
cpe:2.3:a:znc:znc-msvc:0.202:-:-:*:-:windows:*:*0.202Vulnerableznc
  • cpe:2.3:a:znc:znc-msvc:0.095:-:-:*:-:windows:*:* Versions 0.095 Vulnerable ·znc
  • cpe:2.3:a:znc:znc-msvc:0.097:-:-:*:-:windows:*:* Versions 0.097 Vulnerable ·znc
  • cpe:2.3:a:znc:znc-msvc:0.098:-:-:*:-:windows:*:* Versions 0.098 Vulnerable ·znc
  • cpe:2.3:a:znc:znc-msvc:0.202:-:-:*:-:windows:*:* Versions 0.202 Vulnerable ·znc

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2013-7049
  2. 2026-10-03 Alias added: GHSA-rj4x-5f2j-h52p

References

Other 4

  • TI-2012-00032 The CBounceDCCMod::OnPrivCTCP function in bouncedcc.cpp in the bouncedcc module in ZNC… CVSS 2.0MEDIUM 5.0

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences