CVE-2017-5356

Irssi before 0.8.21 allows remote attackers to cause a denial of service (out-of-bounds read and crash) via a string containing a formatting sequence (%[) without a closing bracket (]).

Irssi before 0.8.21 allows remote attackers to cause a denial of service (out-of-bounds read and crash) via a string containing a formatting sequence (%[) without a closing bracket (]).

In irssi before 0.8.21, a NULL pointer dereference in the nickcmp function (CVE-2017-5193).

In irssi before 0.8.21, use after free when receiving invalid nick message (CVE-2017-5194).

In irssi before 0.8.21, out of bounds read in certain incomplete control codes (CVE-2017-5195).

In irssi before 0.8.21, out of bounds read in certain incomplete character sequences (CVE-2017-5196).

In irssi before 0.8.21, out of bounds read when printing certain values (CVE-2017-5356).

These are all security issues fixed in the irssi-1.2.3-2.4 package on the GA media of openSUSE Tumbleweed.

It was discovered that the Irssi buf.pl script set incorrect permissions. A local attacker could use this issue to retrieve another user's window contents. (CVE-2016-7553)

Joseph Bisch discovered that Irssi incorrectly handled comparing nicks. A remote attacker could use this issue to cause Irssi to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2017-5193)

It was discovered that Irssi incorrectly handled invalid nick messages. A remote attacker could use this issue to cause Irssi to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2017-5194)

Joseph Bisch discovered that Irssi incorrectly handled certain incomplete control codes. A remote attacker could use this issue to cause Irssi to crash, resulting in a denial of service, or possibly execute arbitrary code. This issue only affected Ubuntu 16.04 LTS and Ubuntu 16.10. (CVE-2017-5195)

Hanno Böck and Joseph Bisch discovered that Irssi incorrectly handled certain incomplete character sequences. A remote attacker could use this issue to cause Irssi to crash, resulting in a denial of service. This issue only affected Ubuntu 16.04 LTS and Ubuntu 16.10. (CVE-2017-5196)

Hanno Böck discovered that Irssi incorrectly handled certain format strings. A remote attacker could use this issue to cause Irssi to crash, resulting in a denial of service. (CVE-2017-5356)