CVE catalog

CVE-2007-4398

irssi-scripts: CVE-2007-4398

Severity: Medium
Published: Aug 18, 2007, 9:17:00 PM UTC
Source: [NVD] · [CVE record]
EPSS: 1.81% · Oct 25, 2026

Multiple CRLF injection vulnerabilities in the (1) now-playing.rb and (2) xmms.pl 1.1 scripts for WeeChat allow user-assisted remote attackers to execute arbitrary IRC commands via CRLF sequences in the name of the song in a .mp3 file.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

Distribution	Package	Release	Version	Status
Debian	irssi-scripts	sid	`20261024`	fixed
Debian	irssi-scripts	forky	`20231031`	fixed
Debian	irssi-scripts	trixie	`20231031`	fixed
Debian	irssi-scripts	bookworm	`20220704`	fixed
Debian	weechat-scripts	sid	`20260717-1`	fixed
Debian	weechat-scripts	forky	`20260717-1`	fixed
Debian	weechat-scripts	trixie	`20250416-1`	fixed
Debian	weechat-scripts	bookworm	`20221022-1`	fixed

Fixed-version evidence

Distribution	Package	Type	Release	Fixed version	Urgency	Origin	Bugs
Debian	irssi-scripts	source	sid	`20070925`	low	Not reported	[439840]
Debian	irssi-scripts	source	forky	`20070925`	low	Not reported	[439840]
Debian	irssi-scripts	source	trixie	`20070925`	low	Not reported	[439840]
Debian	irssi-scripts	source	bookworm	`20070925`	low	Not reported	[439840]
Debian	weechat-scripts	source	sid	`20070425-0.1`	low	Not reported	[439839]
Debian	weechat-scripts	source	forky	`20070425-0.1`	low	Not reported	[439839]
Debian	weechat-scripts	source	trixie	`20070425-0.1`	low	Not reported	[439839]
Debian	weechat-scripts	source	bookworm	`20070425-0.1`	low	Not reported	[439839]

[Debian bug #439840][Debian bug #439839]

OpenFactory catalog packages

[Debian 12 (Bookworm)]

[irssi-scripts]Fixed
Details (2)
- 20220704 · all · bookworm
  Fixed · Fixed: 20070925
  dsa · irssi-scripts · debian · bookworm; dsa · irssi-scripts · debian · 12
- 20220704 · all · bookworm
  Fixed · Fixed: 20070925
  dsa · irssi-scripts · debian · bookworm; dsa · irssi-scripts · debian · 12
[weechat-scripts]Fixed
Details (2)
- 20221022-1 · all · bookworm
  Fixed · Fixed: 20070425-0.1
  dsa · weechat-scripts · debian · bookworm; dsa · weechat-scripts · debian · 12
- 20221022-1 · all · bookworm
  Fixed · Fixed: 20070425-0.1
  dsa · weechat-scripts · debian · bookworm; dsa · weechat-scripts · debian · 12

[Debian 13 (Trixie)]

[irssi-scripts]Fixed
Details (2)
- 20231031 · all · trixie
  Fixed · Fixed: 20070925
  dsa · irssi-scripts · debian · 13
- 20231031 · all · trixie
  Fixed · Fixed: 20070925
  dsa · irssi-scripts · debian · 13
[weechat-scripts]Fixed
Details (2)
- 20250416-1 · all · trixie
  Fixed · Fixed: 20070425-0.1
  dsa · weechat-scripts · debian · 13
- 20250416-1 · all · trixie
  Fixed · Fixed: 20070425-0.1
  dsa · weechat-scripts · debian · 13

Observed: Oct 23, 2026, 5:03:44 PM UTC

References

[Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database]