Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [day] [month] [year] [list]
Date: Sat, 29 Jun 2019 16:36:29 +0200
From: Ailin Nemui <ailin.nemui@...il.com>
To: oss-security <oss-security@...ts.openwall.com>
Subject: Irssi 1.2.1/1.1.3/1.0.8: CVE-2019-13045

IRSSI-SA-2019-06 Irssi Security Advisory [1]
============================================
CVE-2019-13045

Description
-----------

(a) Use after free when sending SASL login to the server found by
    ilbelkyr. (CWE-416, CWE-825)

    CVE-2019-13045 [2] was assigned to this issue.


Impact
------

May affect the stability of Irssi. SASL logins may fail, especially
during (manual and automated) reconnect.


Affected versions
-----------------

(a) Irssi 0.8.18 and later


Fixed in
--------

Irssi 1.0.8, 1.1.3, 1.2.1


Recommended action
------------------

Upgrade to the latest Irssi. We've published maintenance releases,
without any new features.

After installing the updated packages, one can issue the /upgrade
command to load the new binary. TLS connections will require
/reconnect.


Mitigating facts
----------------

Users who have not configured SASL, are not affected by this issue.



References
----------

[1] https://irssi.org/security/irssi_sa_2019_06.txt
[2] http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-13045


Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.