Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Date: Tue, 06 Jun 2017 23:31:56 +0200
From: Ailin Nemui <>
Subject: FYI: Irssi Security Advisory 2017/06

IRSSI-SA-2017-06 Irssi Security Advisory [1]


Two vulnerabilities have been located in Irssi.

(a) When receiving a DCC message without source nick/host, Irssi would
    attempt to dereference a NULL pointer. Found by Joseph
    Bisch. (CWE-690)

(b) When receiving certain incorrectly quoted DCC files, Irssi would
    try to find the terminating quote one byte before the allocated
    memory. Found by Joseph Bisch. (CWE-129, CWE-127)


(a) May result in denial of service (remote crash).

(b) May result in denial of service (remote crash), but in practice
    this seems to be very unlikely unless address sanitizer is

Affected versions

All Irssi versions that we observed.

Fixed in

Irssi 1.0.3

Recommended action

Upgrade to Irssi 1.0.3. Irssi 1.0.3 is a maintenance release in the
1.0 series, without any new features.

After installing the updated packages, one can issue the /upgrade
command to load the new binary. TLS connections will require

Mitigating facts

(a) requires control over the ircd




Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.