CVE-2015-10025 (published 2023-01-07T13:15Z)

A vulnerability has been found in luelista miniConf up to 1.7.6 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file miniConf/MessageView.cs of the component URL Scanning. The manipulation leads to denial of service. Upgrading to version 1.7.7 and 1.8.0 is able to address this issue. The patch is named c06c2e5116c306e4e1bc79779f0eda2d1182f655. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-217615.

CVSS v3 base score: 7.5, HIGH (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

Weakness information:
cwe_id: CWE-404
cwe_name: Improper Resource Shutdown or Release
description: The product does not release or incorrectly releases a resource before it is made available for re-use.
extended_description: When a resource is created or allocated, the developer is responsible for properly releasing the resource as well as accounting for all potential paths of expiration or invalidation, such as a set period of time or revocation.
         

Fix information:
repo_url: https://github.com/luelista/miniConf
commit_details: repo_url: https://github.com/luelista/miniConf
author: Max Weller
author_date: 2015-08-13 13:26:16+02:00
msg: Version 1.7.7
behebt Denial of Service Bug durch Fehler in URL-scanning Regex
repository: repo_url: https://github.com/luelista/miniConf
repo_name: luelista/miniConf
description: Simple Jabber (XMPP) Client for Windows, optimized for Group Chats
repo_language: C#
owner: luelista
file_changes: filename: codesign-and-make-setup.bat
change_type: ModificationType.MODIFY
diff: @@ -44,7 +44,7 @@ CALL codesign-dragdrop.bat %INSTALLER%
 
 echo.
 echo Step 4 - Uploading as minefield...
-"C:\Program Files (x86)\Git\bin\scp.exe" %INSTALLER% maxweller@cherry.luelistan.net:/srv/hosts/max-weller.de/downloads.max-weller.de/miniconf/miniconf-minefield-setup.exe
+"C:\Program Files (x86)\Git\bin\scp.exe" %INSTALLER% maxweller@oak.teamwiki.net:/var/www/hosts/downloads.max-weller.de/miniconf/miniconf-minefield-setup.exe
 
 
 

programming_language: Batchfile
filename: Form1.cs
change_type: ModificationType.MODIFY
diff: @@ -412,11 +412,13 @@ namespace miniConf {
                             }
                             if (enableNotificationsToolStripMenuItem.Checked && !String.IsNullOrEmpty(messageBody)) {
                                 if (ApplicationPreferences.WineTricks) {
+                                    Console.WriteLine("Displaying notification via notify-send ...");
                                     ProcessStartInfo psi = new ProcessStartInfo();
                                     psi.FileName = "/usr/bin/notify-send";
                                     psi.Arguments = "\"Nachricht von " + msg.From.ToString() + "\" \"" + messageBody + "\"";
                                     Process.Start(psi);
                                 } else {
+                                    Console.WriteLine("Showing balloon tip: " + msg.From.Resource + " in " + msg.From.User);
                                     balloonRoom = msg.From.Bare;
                                     notifyIcon1.ShowBalloonTip(30000, msg.From.Resource + " in " + msg.From.User + ":", messageBody, ToolTipIcon.Info);
                                 }

programming_language: C#
filename: MessageView.cs
change_type: ModificationType.MODIFY
diff: @@ -170,7 +170,7 @@ namespace miniConf {
             if (!String.IsNullOrEmpty(highlightString)) text = Regex.Replace(text, highlightString, "<em>$0</em>");
             text = text.Replace("\n", "\n<br>");
             var imageLink = Regex.Match(text, "https?://[\\w.-]+/[\\w_.,/+?&%$!=)(\\[\\]{}-]*\\.(png|jpg|gif|webp)");
-            text = Regex.Replace(text, "(?i)\\b((?:[a-z][\\w-]+:(?:/{1,3}|[a-z0-9%])|www\\d{0,3}[.]|[a-z0-9.\\-]+[.][a-z]{2,4}/)(?:[^\\s()<>]+|\\(([^\\s()<>]+|(\\([^\\s()<>]+\\)))*\\))+(?:\\(([^\\s()<>]+|(\\([^\\s()<>]+\\)))*\\)|[^\\s`!()\\[\\]{};:'\".,<>?«»“”‘’]))",
+            text = Regex.Replace(text, "(?i)\\b((?:[a-z][\\w-]+:(?:/{1,3})|www\\d{0,3}[.]|[a-z0-9.\\-]+[.][a-z]{2,4}/)(?:[^\\s()<>]+|\\(([^\\s()<>]+|(\\([^\\s()<>]+\\)))*\\))+(?:\\(([^\\s()<>]+|(\\([^\\s()<>]+\\)))*\\)|[^\\s`!()\\[\\]{};:'\".,<>?«»“”‘’]))",
                          (match) => ("<a href=\"" + match.Value.Replace("\"", "&quot;") + "\">" + match.Value + "</a>"));
             if (imagePreview && imageLink.Success) {
                 string link = imageLink.Value; 

programming_language: C#
filename: AssemblyInfo.cs
change_type: ModificationType.MODIFY
diff: @@ -32,5 +32,5 @@ using System.Runtime.InteropServices;
 // Sie können alle Werte angeben oder die standardmäßigen Build- und Revisionsnummern 
 // übernehmen, indem Sie "*" eingeben:
 // [assembly: AssemblyVersion("1.0.*")]
-[assembly: AssemblyVersion("1.7.6.4")]
-[assembly: AssemblyFileVersion("1.7.6.4")]
+[assembly: AssemblyVersion("1.7.7.0")]
+[assembly: AssemblyFileVersion("1.7.7.0")]

programming_language: C#