Summary
Brian Carpenter discovered that Irssi incorrectly handled messages with
invalid time stamps. A malicious IRC server could use this issue to cause
Irssi to crash, resulting in a denial of service. (CVE-2017-10965)
Brian Carpenter discovered that Irssi incorrectly handled the internal nick
list. A malicious IRC server could use this issue to cause Irssi to crash,
resulting in a denial of service. (CVE-2017-10966)
Joseph Bisch discovered that Irssi incorrectly removed destroyed channels
from the query list. A malicious IRC server could use this issue to cause
Irssi to crash, resulting in a denial of service. (CVE-2017-15227)
Hanno Böck discovered that Irssi incorrectly handled themes. If a user were
tricked into using a malicious theme, a attacker could use this issue to
cause Irssi to crash, resulting in a denial of service. (CVE-2017-15228)
Joseph Bisch discovered that Irssi incorrectly handled certain DCC CTCP
messages. A malicious IRC server could use this issue to cause Irssi to
crash, resulting in a denial of service. (CVE-2017-15721)
Joseph Bisch discovered that Irssi incorrectly handled certain channel IDs.
A malicious IRC server could use this issue to cause Irssi to crash,
resulting in a denial of service. (CVE-2017-15722)
Joseph Bisch discovered that Irssi incorrectly handled certain long nicks
or targets. A malicious IRC server could use this issue to cause Irssi to
crash, resulting in a denial of service. (CVE-2017-15723)
Fixed packages 2
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 14.04 LTS 14.04:LTS | irssi | 0.8.15-5ubuntu3.3 |
| Ubuntu · 16.04 LTS 16.04:LTS | irssi | 0.8.19-1ubuntu1.5 |
Vulnerabilities 7
-
Unscored —
An issue was discovered in Irssi before 1.0.4. When receiving messages with invalid time stamps, Irssi would try to der…
-
Unscored —
An issue was discovered in Irssi before 1.0.4. While updating the internal nick list, Irssi could incorrectly use the G…
-
Unscored —
Irssi before 1.0.5, while waiting for the channel synchronisation, may incorrectly fail to remove destroyed channels fr…
-
Unscored —
Irssi before 1.0.5, when installing themes with unterminated colour formatting sequences, may access data beyond the en…
-
Unscored —
In Irssi before 1.0.5, certain incorrectly formatted DCC CTCP messages could cause a NULL pointer dereference. This is …
-
Unscored —
In certain cases, Irssi before 1.0.5 may fail to verify that a Safe channel ID is long enough, causing reads beyond the…
-
Unscored —
In Irssi before 1.0.5, overlong nicks or targets may result in a NULL pointer dereference while splitting the message.
References
-
report
https://ubuntu.com/security/CVE-2017-10965
-
report
https://ubuntu.com/security/CVE-2017-10966
-
report
https://ubuntu.com/security/CVE-2017-15227
-
report
https://ubuntu.com/security/CVE-2017-15228
-
report
https://ubuntu.com/security/CVE-2017-15721
-
report
https://ubuntu.com/security/CVE-2017-15722
-
report
https://ubuntu.com/security/CVE-2017-15723