[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Date: Sat, 11 Mar 2017 22:25:55 +0100
From: Ailin Nemui <ailin.nemui@...il.com>
To: oss-security@...ts.openwall.com
Subject: CVE Request: Irssi use after free in netjoin condition (2017/03)
Dear CVE Assignment Team,
please provide CVE for the following issue:
use after free condition during netjoin processing [1]
======================================================
CWE Classification: CWE-416
Description
-----------
Use after free while producing list of netjoins (CWE-416)
This issue was found and reported to us by APic.
Impact
------
This issue usually leads to segmentation faults. Targeted code
execution should be difficult.
Affected versions
-----------------
Irssi up to and including 1.0.1
We believe Irssi 0.8.21 and prior are not affected since a different
code path causes the netjoins to be flushed prior to reaching the use
after free condition.
Fixed in
--------
Irssi 1.0.2
Recommended action
------------------
Upgrade to Irssi 1.0.2. Irssi 1.0.2 is a maintenance release
without any new features.
Patch
-----
https://github.com/irssi/irssi/commit/77b2631c78461965bc9a7414aae206b5c
514e1b3
References
----------
[1] https://irssi.org/security/irssi_sa_2017_03.txt
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
