Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Date: Sat, 24 Sep 2016 15:44:19 +0200
From: Salvatore Bonaccorso <>
To: OSS Security Mailinglist <>
Subject: CVE Request: irssi: information disclosure vulnerabilit in


An information disclosure vulnerability in the script provided
by irssi, a terminal based IRC client has been found. Quoting the
advisory at:

> update available
> Posted on September 22^nd 2016
> An information disclosure vulnerability was found, reported and fixed
> in the script by its author.
> CWE Classification: CWE-732, CWE-538
> Impact
> Other users on the same machine may be able to retrieve the whole
> window contents after /UPGRADE when the script is loaded.
> Furthermore, this dump of the windows contents is never removed
> afterwards.
> Since is also an Irssi core script and we recommended its use
> to retain your window content, many people could potentially be
> affected by this.
> Remote users may be able to retrieve these contents when combined with
> other path traversal vulnerabilities in public facing services on that
> machine.
> Detailed analysis
> restores the scrollbuffer between “/upgrade”s by writing the
> contents to a file, and reading that after the new process was
> spawned. Through that file, the contents of (private) chat
> conversations may leak to other users.
> Mitigating facts
> Careful users with a limited umask (e.g. 077) are not affected by this
> bug.  However, most Linux systems default to a umask of 022, meaning
> that files written without further restricting the permissions, are
> readable by any user.
> Affected versions
> All up to 2.13
> Fixed versions
> 2.20
> Resolution
> Update the script with the latest version from

Upstream fix:

Debian Bug report:

Could a CVE be assigned for this issue?


Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.