Critical Use-After-Free Vulnerability in Irssi Package
Summary
ALPINE-CVE-2018-7054: An issue was discovered in Irssi before 1.0.7 and 1.1.x before 1.1.1. Affects irssi versions < 1.1.1-r0. Fixed in 1.1.1-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Irssi is a popular terminal-based IRC client that allows users to connect to multiple IRC networks and channels. It is known for its extensibility and support for various protocols. However, Irssi has been found to have a critical vulnerability that affects its stability and security, particularly during network disruptions.
Vulnerability Detail
An issue was discovered in Irssi versions prior to 1.0.7 and 1.1.x before 1.1.1, where a use-after-free condition occurs when a server is disconnected during netsplits. This vulnerability arises from an incomplete fix for CVE-2017-7191, leading to potential memory corruption and exploitation risks. The ramifications of this vulnerability are severe, as it could allow attackers to execute arbitrary code or crash the application, compromising user data and system integrity.
How To Fix
Minimum fixed version
1.1.1-r0
This is the first release that contains the fix.
sudo apk add --upgrade irssiTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can avoid using Irssi during unstable network conditions to mitigate the risk of triggering the vulnerability until the package is updated.
Conclusion
The Irssi package has a critical use-after-free vulnerability that can lead to severe security risks. Users are strongly advised to update to the latest patched version to protect their systems. Monitoring tools like Vulert can help in identifying such vulnerabilities in real-time.
See every vulnerability recorded for irssi →
FAQ
A use-after-free vulnerability occurs when a program continues to use a memory reference after it has been freed, potentially leading to memory corruption and exploitation.
You can verify your version of Irssi by running 'irssi --version' in your terminal. If it is below 1.1.1, it is vulnerable.
The risks include potential remote code execution, application crashes, and unauthorized access to sensitive data.
Yes, you can use Vulert, which monitors and alerts for open-source vulnerabilities in your software using just a manifest file. You can check your application for vulnerabilities at Vulert Scanner.
The CVSS score of this vulnerability is 9.8, indicating a critical level of severity.
References
Related vulnerabilities
Recent vulnerabilities recorded for irssi.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
