Openwall GNU/*/Linux - a small security-enhanced Linux distro for servers
[<prev] [next>] [day] [month] [year] [list]
Date: Thu, 15 Feb 2018 20:04:14 +0100
From: Ailin Nemui <>
Subject: Irssi 1.1.1&1.0.7: CVE-2018-7054, CVE-2018-7053, CVE-2018-7050,
 CVE-2018-7052, CVE-2018-7051

IRSSI-SA-2018-02 Irssi Security Advisory [1]
CVE-2018-7054, CVE-2018-7053, CVE-2018-7050, CVE-2018-7052, CVE-2018-


Multiple vulnerabilities have been located in Irssi.

(a) Use after free when server is disconnected during netsplits. Found
    by Joseph Bisch. (CWE-416, CWE-825)

    CVE-2018-7054 [2] was assigned to this issue.

(b) Use after free when SASL messages are received in unexpected order.
    Found by Joseph Bisch. (CWE-416, CWE-691)

    CVE-2018-7053 [3] was assigned to this issue.

(c) Null pointer dereference when an "empty" nick has been observed by
    Irssi. Found by Joseph Bisch. (CWE-476, CWE-475)

    CVE-2018-7050 [4] was assigned to this issue.

(d) When the number of windows exceed the available space, Irssi would
    crash due to Null pointer dereference. Found by Joseph Bisch.

    CVE-2018-7052 [5] was assigned to this issue.

(e) Certain nick names could result in out of bounds access when
    printing theme strings. Found by Oss-Fuzz. (CWE-126)

    CVE-2018-7051 [6] was assigned to this issue.

Affected versions

(a) Irssi 1.0.0 and later

(b) Irssi 0.8.18 and later

(c) All Irssi versions that we observed

(d) All Irssi versions that we observed

(e) Irssi 0.8.7 and later

Fixed in

Irssi 1.0.7, 1.1.1

Recommended action

Upgrade to the latest stable Irssi version. Irssi 1.0.7 and 1.1.1 are
maintenance release in the 1.0 and 1.1 series, without any new

After installing the updated packages, one can issue the /upgrade
command to load the new binary. TLS connections will require

Mitigating facts

(b) requires a non-conforming ircd

(c) requires a broken ircd or control over the ircd

(d) depends on non-default configuration



Powered by blists - more mailing lists

Your e-mail address:

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Powered by Openwall GNU/*/Linux - Powered by OpenVZ