oss-sec mailing list archives
CVE Request: Irssi use after free in netjoin condition (2017/03)
From: Ailin Nemui <ailin.nemui () gmail com>
Date: Sat, 11 Mar 2017 22:25:55 +0100
Dear CVE Assignment Team, please provide CVE for the following issue: use after free condition during netjoin processing [1] ====================================================== CWE Classification: CWE-416 Description ----------- Use after free while producing list of netjoins (CWE-416) This issue was found and reported to us by APic. Impact ------ This issue usually leads to segmentation faults. Targeted code execution should be difficult. Affected versions ----------------- Irssi up to and including 1.0.1 We believe Irssi 0.8.21 and prior are not affected since a different code path causes the netjoins to be flushed prior to reaching the use after free condition. Fixed in -------- Irssi 1.0.2 Recommended action ------------------ Upgrade to Irssi 1.0.2. Irssi 1.0.2 is a maintenance release without any new features. Patch ----- https://github.com/irssi/irssi/commit/77b2631c78461965bc9a7414aae206b5c 514e1b3 References ---------- [1] https://irssi.org/security/irssi_sa_2017_03.txt
Current thread:
- CVE Request: Irssi use after free in netjoin condition (2017/03) Ailin Nemui (Mar 11)
- Re: CVE Request: Irssi use after free in netjoin condition (2017/03) Emilio Pozuelo Monfort (Mar 12)
- Re: CVE Request: Irssi use after free in netjoin condition (2017/03) Ailin Nemui (Mar 20)