In Irssi before 1.0.5, certain incorrectly formatted DCC CTCP messages could cause a NULL pointer dereference. This is a separate, but similar, issue relative to CVE-2017-9468.
Weakness
The product dereferences a pointer that it expects to be valid but is NULL.
Affected Software
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Irssi | Irssi | * | 1.0.4 (including) |
| Irssi | Ubuntu | artful | * |
| Irssi | Ubuntu | devel | * |
| Irssi | Ubuntu | esm-infra/xenial | * |
| Irssi | Ubuntu | trusty | * |
| Irssi | Ubuntu | xenial | * |
| Irssi | Ubuntu | zesty | * |
Potential Mitigations
References
- http://openwall.com/lists/oss-security/2017/10/22/4
- https://irssi.org/security/irssi_sa_2017_10.txt
- https://lists.debian.org/debian-lts-announce/2017/12/msg00022.html
- https://www.debian.org/security/2017/dsa-4016
- http://openwall.com/lists/oss-security/2017/10/22/4
- https://irssi.org/security/irssi_sa_2017_10.txt
- https://lists.debian.org/debian-lts-announce/2017/12/msg00022.html
- https://www.debian.org/security/2017/dsa-4016