CVE catalog

CVE-2009-4016

ircd-hybrid: CVE-2009-4016

[CVE catalog]

Severity
High
Published
Source
[NVD] · [CVE record]
EPSS
4.03% · Oct 25, 2026

Integer underflow in the clean_string function in irc_string.c in (1) IRCD-hybrid 7.2.2 and 7.2.3, (2) ircd-ratbox before 2.2.9, and (3) oftc-hybrid before 1.6.8, when flatten_links is disabled, allows remote attackers to execute arbitrary code or cause a denial of service (daemon crash) via a LINKS command.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianircd-hybridsid1:8.2.46+dfsg.1-1fixed
Debianircd-hybridtrixie1:8.2.46+dfsg.1-1fixed
Debianircd-hybridbookworm1:8.2.43+dfsg.1-1fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianircd-hybridsourcesid1:7.2.2.dfsg.2-6.1mediumNot reported[567192]
Debianircd-hybridsourcetrixie1:7.2.2.dfsg.2-6.1mediumNot reported[567192]
Debianircd-hybridsourcebookworm1:7.2.2.dfsg.2-6.1mediumNot reported[567192]

[Debian bug #567192]

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [hybrid-dev]Fixed

    Source package: [ircd-hybrid]

    Details (2)

    • 1:8.2.43+dfsg.1-1 · all · bookworm

      Fixed · Fixed: 1:7.2.2.dfsg.2-6.1

      dsa · ircd-hybrid · debian · bookworm; dsa · ircd-hybrid · debian · 12

    • 1:8.2.43+dfsg.1-1 · all · bookworm

      Fixed · Fixed: 1:7.2.2.dfsg.2-6.1

      dsa · ircd-hybrid · debian · bookworm; dsa · ircd-hybrid · debian · 12

  • [ircd-hybrid]Fixed
    Details (2)

    • 1:8.2.43+dfsg.1-1 · amd64 · bookworm

      Fixed · Fixed: 1:7.2.2.dfsg.2-6.1

      dsa · ircd-hybrid · debian · bookworm; dsa · ircd-hybrid · debian · 12

    • 1:8.2.43+dfsg.1-1 · arm64 · bookworm

      Fixed · Fixed: 1:7.2.2.dfsg.2-6.1

      dsa · ircd-hybrid · debian · bookworm; dsa · ircd-hybrid · debian · 12

[Debian 13 (Trixie)]

  • [hybrid-dev]Fixed

    Source package: [ircd-hybrid]

    Details (2)

    • 1:8.2.46+dfsg.1-1 · all · trixie

      Fixed · Fixed: 1:7.2.2.dfsg.2-6.1

      dsa · ircd-hybrid · debian · 13

    • 1:8.2.46+dfsg.1-1 · all · trixie

      Fixed · Fixed: 1:7.2.2.dfsg.2-6.1

      dsa · ircd-hybrid · debian · 13

  • [ircd-hybrid]Fixed
    Details (2)

    • 1:8.2.46+dfsg.1-1 · amd64 · trixie

      Fixed · Fixed: 1:7.2.2.dfsg.2-6.1

      dsa · ircd-hybrid · debian · 13

    • 1:8.2.46+dfsg.1-1 · arm64 · trixie

      Fixed · Fixed: 1:7.2.2.dfsg.2-6.1

      dsa · ircd-hybrid · debian · 13

Observed:

References

[Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database]