CVE-2017-9468
In Irssi before 1.0.3, when receiving a DCC message without source nick/host, it attempts to...
In Irssi before 1.0.3, when receiving a DCC message without source nick/host, it attempts to dereference a NULL pointer. Thus, remote IRC servers can cause a crash.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
In Irssi before 1.0.3, when receiving a DCC message without source nick/host, it attempts to dereference a NULL pointer. Thus, remote IRC servers can cause a crash.
- Record
CVE-2017-9468- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:N/I:N/A:P - Weakness
- CWE-476
- Updated
- 2026-11-02
CVE List No score
In Irssi before 1.0.3, when receiving a DCC message without source nick/host, it attempts to dereference a NULL pointer. Thus, remote IRC servers can cause a crash.
- Record
CVE-2017-9468- Updated
- 2026-11-02
EUVDEUVD-2017-18400 No score
In Irssi before 1.0.3, when receiving a DCC message without source nick/host, it attempts to dereference a NULL pointer. Thus, remote IRC servers can cause a crash.
- Record
EUVD-2017-18400- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-8366-xqph-v5cf
In Irssi before 1.0.3, when receiving a DCC message without source nick/host, it attempts to...
In Irssi before 1.0.3, when receiving a DCC message without source nick/host, it attempts to dereference a NULL pointer. Thus, remote IRC servers can cause a crash.
- Record
GHSA-8366-xqph-v5cf- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-476
- Updated
- 2026-11-02
OSVALPINE-CVE-2017-9468
In Irssi before 1.0.3, when receiving a DCC message without source nick/host, it attempts to dereference a NULL pointer. Thus, remote IRC servers can cause a crash.
- Record
ALPINE-CVE-2017-9468- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSV
In Irssi before 1.0.3, when receiving a DCC message without source nick/host, it attempts to dereference a NULL pointer. Thus, remote IRC servers can cause a crash.
- Record
CVE-2017-9468- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
Show 7 moreShow less
OSVDEBIAN-CVE-2017-9468
In Irssi before 1.0.3, when receiving a DCC message without source nick/host, it attempts to dereference a NULL pointer. Thus, remote IRC servers can cause a crash.
- Record
DEBIAN-CVE-2017-9468- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2017-9468
In Irssi before 1.0.3, when receiving a DCC message without source nick/host, it attempts to dereference a NULL pointer. Thus, remote IRC servers can cause a crash.
- Record
UBUNTU-CVE-2017-9468- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVMGASA-2017-0185 No score
Updated irssi packages fix security vulnerabilities
It was discovered that Irssi incorrectly handled certain DCC messages. A malicious IRC server could use this issue to cause Irssi to crash, resulting in a denial of service (CVE-2017-9468).
Joseph Bisch discovered that Irssi incorrectly handled receiving incorrectly quoted DCC files. A remote attacker could possibly use this issue to cause Irssi to crash, resulting in a denial of service (CVE-2017-9469).
- Record
MGASA-2017-0185- Updated
- 2026-11-02
OSVopenSUSE-SU-2017:1505-1 No score
Security update for irssi
This update to irssi 1.0.3 fixes the following vulnerabilities:
- CVE-2017-9469: irssi: dcc crash with incorrect quoting (bsc#1043052)
- CVE-2017-9468: irssi: dcc message crash without nick/host (bsc#1043051)
- Record
openSUSE-SU-2017:1505-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2017:1515-1 No score
Security update for irssi
This update to irssi 1.0.3 fixes the following vulnerabilities:
- CVE-2017-9469: irssi: dcc crash with incorrect quoting (bsc#1043052)
- CVE-2017-9468: irssi: dcc message crash without nick/host (bsc#1043051)
- Record
openSUSE-SU-2017:1515-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:10865-1 No score
irssi-1.2.3-2.4 on GA media
These are all security issues fixed in the irssi-1.2.3-2.4 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:10865-1- Updated
- 2026-11-02
OSVUSN-3317-1 No score
irssi vulnerabilities
It was discovered that Irssi incorrectly handled certain DCC messages. A malicious IRC server could use this issue to cause Irssi to crash, resulting in a denial of service. (CVE-2017-9468)
Joseph Bisch discovered that Irssi incorrectly handled receiving incorrectly quoted DCC files. A remote attacker could possibly use this issue to cause Irssi to crash, resulting in a denial of service. (CVE-2017-9469)
- Record
USN-3317-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
irssiAlpine:v3.10 |
before 1.0.3-r0 | 1.0.3-r0 |
irssiAlpine:v3.11 |
before 1.0.3-r0 | 1.0.3-r0 |
irssiAlpine:v3.12 |
before 1.0.3-r0 | 1.0.3-r0 |
irssiAlpine:v3.13 |
before 1.0.3-r0 | 1.0.3-r0 |
irssiAlpine:v3.14 |
before 1.0.3-r0 | 1.0.3-r0 |
irssiAlpine:v3.15 |
before 1.0.3-r0 | 1.0.3-r0 |
irssiAlpine:v3.16 |
before 1.0.3-r0 | 1.0.3-r0 |
irssiAlpine:v3.17 |
before 1.0.3-r0 | 1.0.3-r0 |
irssiAlpine:v3.3 |
before 0.8.21-r1 | 0.8.21-r1 |
irssiAlpine:v3.4 |
before 0.8.21-r1 | 0.8.21-r1 |
Show 16 moreShow less
| Package | Affected | Fixed |
|---|---|---|
irssiAlpine:v3.5 |
before 0.8.21-r1 | 0.8.21-r1 |
irssiAlpine:v3.6 |
before 1.0.3-r0 | 1.0.3-r0 |
irssiAlpine:v3.7 |
before 1.0.3-r0 | 1.0.3-r0 |
irssiAlpine:v3.8 |
before 1.0.3-r0 | 1.0.3-r0 |
irssiAlpine:v3.9 |
before 1.0.3-r0 | 1.0.3-r0 |
irssiDebian:12 |
before 1.0.3-1 | 1.0.3-1 |
irssiDebian:13 |
before 1.0.3-1 | 1.0.3-1 |
irssiDebian:14 |
before 1.0.3-1 | 1.0.3-1 |
irssiDebian:7 |
before 0.8.15-5+deb7u2, plus listed versions 0.8.15-50.8.15-5+deb7u1 |
0.8.15-5+deb7u2 |
irssiDebian:8 |
before 0.8.17-1+deb8u4, plus listed versions 0.8.17-10.8.17-1+deb8u10.8.17-1+deb8u1~bpo70+10.8.17-1+deb8u20.8.17-1+deb8u3 |
0.8.17-1+deb8u4 |
irssiDebian:9 |
before 1.0.2-1+deb9u1, plus listed versions 1.0.2-1 |
1.0.2-1+deb9u1 |
irssiMageia:5 |
before 0.8.21-1.1.mga5 | 0.8.21-1.1.mga5 |
irssiUbuntu:14.04:LTS |
before 0.8.15-5ubuntu3.2, plus listed versions 0.8.15-5ubuntu20.8.15-5ubuntu30.8.15-5ubuntu3.1 |
0.8.15-5ubuntu3.2 |
irssiUbuntu:16.04:LTS |
before 0.8.19-1ubuntu1.4, plus listed versions 0.8.17-1ubuntu10.8.17-1ubuntu20.8.18-1ubuntu10.8.19-1ubuntu10.8.19-1ubuntu1.20.8.19-1ubuntu1.3 |
0.8.19-1ubuntu1.4 |
irssiSUSE:Package Hub 12 |
before 1.0.3-25.1 | 1.0.3-25.1 |
irssiopenSUSE:Tumbleweed |
before 1.2.3-2.4 | 1.2.3-2.4 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2017-9468 is a high vulnerability (CVSS 7.5) in Irssi, published June 6, 2017. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 3.66%, the 89th percentile. Fixed in irssi 1.0.3-r0.
References
debian.org/security/2017/dsa-3885
openwall.com/lists/oss-security/2017/06/06/4
irssi.org/security/irssi_sa_2017_06.txt
securityfocus.com/bid/99015
securitytracker.com/id/1038621
nvd.nist.gov/vuln/detail/CVE-2017-9468
Show 38 moreShow less
github.com/advisories/GHSA-8366-xqph-v5cf
security.alpinelinux.org/vuln/CVE-2017-9468
security-tracker.debian.org/tracker/CVE-2017-9468
advisories.mageia.org/MGASA-2017-0185.html
bugs.mageia.org/show_bug.cgi?id=21037
ubuntu.com/usn/usn-3317-1
ubuntu.com/security/CVE-2017-9468
cve.org/CVERecord?id=CVE-2017-9468
bugzilla.suse.com/1043051
suse.com/security/cve/CVE-2017-9468