oss-sec mailing list archives
FYI: Irssi Security Advisory 2017/06
From: Ailin Nemui <ailin.nemui () gmail com>
Date: Tue, 06 Jun 2017 23:31:56 +0200
IRSSI-SA-2017-06 Irssi Security Advisory [1] ============================================ Description ----------- Two vulnerabilities have been located in Irssi. (a) When receiving a DCC message without source nick/host, Irssi would attempt to dereference a NULL pointer. Found by Joseph Bisch. (CWE-690) (b) When receiving certain incorrectly quoted DCC files, Irssi would try to find the terminating quote one byte before the allocated memory. Found by Joseph Bisch. (CWE-129, CWE-127) Impact ------ (a) May result in denial of service (remote crash). (b) May result in denial of service (remote crash), but in practice this seems to be very unlikely unless address sanitizer is enabled. Affected versions ----------------- All Irssi versions that we observed. Fixed in -------- Irssi 1.0.3 Recommended action ------------------ Upgrade to Irssi 1.0.3. Irssi 1.0.3 is a maintenance release in the 1.0 series, without any new features. After installing the updated packages, one can issue the /upgrade command to load the new binary. TLS connections will require /reconnect. Mitigating facts ---------------- (a) requires control over the ircd Patch ----- https://github.com/irssi/irssi/commit/fb08fc7f1aa6b2e616413d003bf021612 301ad55 References ---------- [1] https://irssi.org/security/irssi_sa_2017_06.txt
Current thread:
- FYI: Irssi Security Advisory 2017/06 Ailin Nemui (Jun 06)
- Re: CVE-2017-9468, CVE-2017-9469: Irssi Security Advisory 2017/06 Ailin Nemui (Jun 07)