Security Update for irssi
Summary
DLA-1089-1: irssi - security update. Affects irssi versions < 0.8.15-5+deb7u3. Fixed in 0.8.15-5+deb7u3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Irssi is an open-source chat client for UNIX-like operating systems. It is designed to be highly customizable and extensible, allowing users to connect to multiple chat networks simultaneously. However, a vulnerability has been discovered in versions prior to 1.0.4 that could lead to a NULL pointer dereference and use-after-free conditions.
Vulnerability Detail
The vulnerability, identified as CVE-2017-10965, occurs when Irssi receives messages with invalid time stamps. In such cases, the software attempts to dereference a NULL pointer, resulting in a crash or potential code execution. Another vulnerability, CVE-2017-10966, involves the incorrect usage of the GHashTable interface during the internal nick list update process. This can lead to use-after-free conditions, causing the software to crash or potentially execute arbitrary code.
How To Fix
Minimum fixed version
0.8.15-5+deb7u3
This is the first release that contains the fix.
sudo apt-get install --only-upgrade irssiTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There are no known workarounds for these vulnerabilities. It is crucial to apply the provided security update to ensure the integrity and security of your system.
Conclusion
It is crucial to promptly upgrade your irssi packages to the recommended version in order to mitigate the identified vulnerabilities. Failure to do so may result in crashes or potential code execution. For further assistance or support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for irssi →
FAQ
Irssi is an open-source chat client that allows users to connect to multiple chat networks simultaneously. It is highly customizable and extensible.
The vulnerabilities in Irssi are identified as CVE-2017-10965 and CVE-2017-10966. They can lead to NULL pointer dereference and use-after-free conditions.
These vulnerabilities can result in crashes or potential code execution, compromising the stability and security of the affected system.
To fix these vulnerabilities, you need to upgrade your irssi packages to version 0.8.15-5+deb7u3 for Debian 7 Wheezy.
No, there are no known workarounds for these vulnerabilities. It is essential to apply the provided security update.
Related vulnerabilities
Recent vulnerabilities recorded for irssi.
