Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [day] [month] [year] [list]
Date: Wed, 10 Feb 2016 15:26:47 +0000
From: Shubham Shah <>
To: "" <>,
	"" <>
CC: Joe DeMesy <>, Michael Morris <>
Subject: CVE Request: Textual IRC Client <= 5.2.7 Remote Command Execution


We would like to request a CVE for a remote command execution vulnerability in the Textual IRC client <= 5.2.7 for OS X. 

An attacker is able to send messages to users of the Textual IRC Client 5.2.7 and below in order to inject arbitrary JavaScript within Textual’s web view upon limited user interaction. Unspecified attack vectors could allow for an attacker to achieve remote command execution on a victim’s machine, through the Textual IRC client.

The vendor has released a fix as seen in the following GitHub commit:

A patch has been released by the vendor and this security vulnerability has been fixed in Textual 5.2.8 as seen in the release notes:

The release notes will be updated to include any CVE’s assigned for this remote command execution vulnerability.

This vulnerability was found by Shubham Shah and Joe DeMesy of Bishop Fox.


Shubham Shah

Phone: +61 0412 609 761
Fax: (480) 383-6401


Content of type "text/html" skipped

Download attachment "smime.p7s" of type "application/pkcs7-signature" (4512 bytes)

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.