Openwall GNU/*/Linux - a small security-enhanced Linux distro for servers
[<prev] [next>] [day] [month] [year] [list]
Date: Thu, 10 Jan 2019 00:21:04 +0100
From: Ailin Nemui <ailin.nemui@...il.com>
To: oss-security@...ts.openwall.com
Subject: Irssi 1.1.2: CVE-2019-5882

IRSSI-SA-2019-01 Irssi Security Advisory [1]
============================================
CVE-2019-5882

Description
-----------

(a) Use after free when hidden lines were expired from the scroll
    buffer. (CWE-417, CWE-825)

    CVE-2019-5882 [2] was assigned to this issue.


Impact
------

May affect the stability of Irssi.


Affected versions
-----------------

(a) Irssi 1.1.0 and later


Fixed in
--------

Irssi 1.1.2


Recommended action
------------------

Upgrade to Irssi 1.1.2. Irssi 1.1.2 is a maintenance release in the 1.1
series, without any new features.

After installing the updated packages, one can issue the /upgrade
command to load the new binary. TLS connections will require /reconnect.


Mitigating facts
----------------

(a) If lines are never hidden (no usage of /window hidelevel), this bug
    will not trigger.



References
----------

[1] https://irssi.org/security/irssi_sa_2019_01.txt
[2] http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5882


Powered by blists - more mailing lists

Your e-mail address:

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.