CVE-2017-10965

An issue was discovered in Irssi before 1.0.4. When receiving messages with invalid time stamps, Irssi would try to dereference a NULL pointer.

An issue was discovered in Irssi before 1.0.4. When receiving messages with invalid time stamps, Irssi would try to dereference a NULL pointer.

A malicious server could cause irssi to crash by providing an invalid timestamp (CVE-2017-10965).

Undefined behavior may be triggered when irssi updates the internal nick list (CVE-2017-10966).

This update for irssi to version fixes the following issues:

• CVE-2017-10965: A malicious server could cause irssi to crash by providing an invalid timestamp
• CVE-2017-10966: Undefined behavior may be triggered when irssi updates the internal nick list

A number of minor upstream bug fixes are also included.

This update for irssi to version fixes the following issues:

• CVE-2017-10965: A malicious server could cause irssi to crash by providing an invalid timestamp
• CVE-2017-10966: Undefined behavior may be triggered when irssi updates the internal nick list

A number of minor upstream bug fixes are also included.

These are all security issues fixed in the irssi-1.2.3-2.4 package on the GA media of openSUSE Tumbleweed.

Brian Carpenter discovered that Irssi incorrectly handled messages with invalid time stamps. A malicious IRC server could use this issue to cause Irssi to crash, resulting in a denial of service. (CVE-2017-10965)

Brian Carpenter discovered that Irssi incorrectly handled the internal nick list. A malicious IRC server could use this issue to cause Irssi to crash, resulting in a denial of service. (CVE-2017-10966)

Joseph Bisch discovered that Irssi incorrectly removed destroyed channels from the query list. A malicious IRC server could use this issue to cause Irssi to crash, resulting in a denial of service. (CVE-2017-15227)

Hanno Böck discovered that Irssi incorrectly handled themes. If a user were tricked into using a malicious theme, a attacker could use this issue to cause Irssi to crash, resulting in a denial of service. (CVE-2017-15228)

Joseph Bisch discovered that Irssi incorrectly handled certain DCC CTCP messages. A malicious IRC server could use this issue to cause Irssi to crash, resulting in a denial of service. (CVE-2017-15721)

Joseph Bisch discovered that Irssi incorrectly handled certain channel IDs. A malicious IRC server could use this issue to cause Irssi to crash, resulting in a denial of service. (CVE-2017-15722)

Joseph Bisch discovered that Irssi incorrectly handled certain long nicks or targets. A malicious IRC server could use this issue to cause Irssi to crash, resulting in a denial of service. (CVE-2017-15723)