CVE-2017-9469
In Irssi before 1.0.3, when receiving certain incorrectly quoted DCC files, it tries to find the...
In Irssi before 1.0.3, when receiving certain incorrectly quoted DCC files, it tries to find the terminating quote one byte before the allocated memory. Thus, remote attackers might be able to cause a crash.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
In Irssi before 1.0.3, when receiving certain incorrectly quoted DCC files, it tries to find the terminating quote one byte before the allocated memory. Thus, remote attackers might be able to cause a crash.
- Record
CVE-2017-9469- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:N/I:N/A:P - Weakness
- CWE-119
- Updated
- 2026-11-02
CVE List No score
In Irssi before 1.0.3, when receiving certain incorrectly quoted DCC files, it tries to find the terminating quote one byte before the allocated memory. Thus, remote attackers might be able to cause a crash.
- Record
CVE-2017-9469- Updated
- 2026-11-02
EUVDEUVD-2017-18401 No score
In Irssi before 1.0.3, when receiving certain incorrectly quoted DCC files, it tries to find the terminating quote one byte before the allocated memory. Thus, remote attackers might be able to cause a crash.
- Record
EUVD-2017-18401- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-4fcw-x547-92cj
In Irssi before 1.0.3, when receiving certain incorrectly quoted DCC files, it tries to find the...
In Irssi before 1.0.3, when receiving certain incorrectly quoted DCC files, it tries to find the terminating quote one byte before the allocated memory. Thus, remote attackers might be able to cause a crash.
- Record
GHSA-4fcw-x547-92cj- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-119
- Updated
- 2026-11-02
OSVALPINE-CVE-2017-9469
In Irssi before 1.0.3, when receiving certain incorrectly quoted DCC files, it tries to find the terminating quote one byte before the allocated memory. Thus, remote attackers might be able to cause a crash.
- Record
ALPINE-CVE-2017-9469- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSV
In Irssi before 1.0.3, when receiving certain incorrectly quoted DCC files, it tries to find the terminating quote one byte before the allocated memory. Thus, remote attackers might be able to cause a crash.
- Record
CVE-2017-9469- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
Show 7 moreShow less
OSVDEBIAN-CVE-2017-9469
In Irssi before 1.0.3, when receiving certain incorrectly quoted DCC files, it tries to find the terminating quote one byte before the allocated memory. Thus, remote attackers might be able to cause a crash.
- Record
DEBIAN-CVE-2017-9469- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2017-9469
In Irssi before 1.0.3, when receiving certain incorrectly quoted DCC files, it tries to find the terminating quote one byte before the allocated memory. Thus, remote attackers might be able to cause a crash.
- Record
UBUNTU-CVE-2017-9469- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVMGASA-2017-0185 No score
Updated irssi packages fix security vulnerabilities
It was discovered that Irssi incorrectly handled certain DCC messages. A malicious IRC server could use this issue to cause Irssi to crash, resulting in a denial of service (CVE-2017-9468).
Joseph Bisch discovered that Irssi incorrectly handled receiving incorrectly quoted DCC files. A remote attacker could possibly use this issue to cause Irssi to crash, resulting in a denial of service (CVE-2017-9469).
- Record
MGASA-2017-0185- Updated
- 2026-11-02
OSVopenSUSE-SU-2017:1505-1 No score
Security update for irssi
This update to irssi 1.0.3 fixes the following vulnerabilities:
- CVE-2017-9469: irssi: dcc crash with incorrect quoting (bsc#1043052)
- CVE-2017-9468: irssi: dcc message crash without nick/host (bsc#1043051)
- Record
openSUSE-SU-2017:1505-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2017:1515-1 No score
Security update for irssi
This update to irssi 1.0.3 fixes the following vulnerabilities:
- CVE-2017-9469: irssi: dcc crash with incorrect quoting (bsc#1043052)
- CVE-2017-9468: irssi: dcc message crash without nick/host (bsc#1043051)
- Record
openSUSE-SU-2017:1515-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:10865-1 No score
irssi-1.2.3-2.4 on GA media
These are all security issues fixed in the irssi-1.2.3-2.4 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:10865-1- Updated
- 2026-11-02
OSVUSN-3317-1 No score
irssi vulnerabilities
It was discovered that Irssi incorrectly handled certain DCC messages. A malicious IRC server could use this issue to cause Irssi to crash, resulting in a denial of service. (CVE-2017-9468)
Joseph Bisch discovered that Irssi incorrectly handled receiving incorrectly quoted DCC files. A remote attacker could possibly use this issue to cause Irssi to crash, resulting in a denial of service. (CVE-2017-9469)
- Record
USN-3317-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
irssiAlpine:v3.10 |
before 1.0.3-r0 | 1.0.3-r0 |
irssiAlpine:v3.11 |
before 1.0.3-r0 | 1.0.3-r0 |
irssiAlpine:v3.12 |
before 1.0.3-r0 | 1.0.3-r0 |
irssiAlpine:v3.13 |
before 1.0.3-r0 | 1.0.3-r0 |
irssiAlpine:v3.14 |
before 1.0.3-r0 | 1.0.3-r0 |
irssiAlpine:v3.15 |
before 1.0.3-r0 | 1.0.3-r0 |
irssiAlpine:v3.16 |
before 1.0.3-r0 | 1.0.3-r0 |
irssiAlpine:v3.17 |
before 1.0.3-r0 | 1.0.3-r0 |
irssiAlpine:v3.6 |
before 1.0.3-r0 | 1.0.3-r0 |
irssiAlpine:v3.7 |
before 1.0.3-r0 | 1.0.3-r0 |
Show 13 moreShow less
| Package | Affected | Fixed |
|---|---|---|
irssiAlpine:v3.8 |
before 1.0.3-r0 | 1.0.3-r0 |
irssiAlpine:v3.9 |
before 1.0.3-r0 | 1.0.3-r0 |
irssiDebian:12 |
before 1.0.3-1 | 1.0.3-1 |
irssiDebian:13 |
before 1.0.3-1 | 1.0.3-1 |
irssiDebian:14 |
before 1.0.3-1 | 1.0.3-1 |
irssiDebian:7 |
before 0.8.15-5+deb7u2, plus listed versions 0.8.15-50.8.15-5+deb7u1 |
0.8.15-5+deb7u2 |
irssiDebian:8 |
before 0.8.17-1+deb8u4, plus listed versions 0.8.17-10.8.17-1+deb8u10.8.17-1+deb8u1~bpo70+10.8.17-1+deb8u20.8.17-1+deb8u3 |
0.8.17-1+deb8u4 |
irssiDebian:9 |
before 1.0.2-1+deb9u1, plus listed versions 1.0.2-1 |
1.0.2-1+deb9u1 |
irssiMageia:5 |
before 0.8.21-1.1.mga5 | 0.8.21-1.1.mga5 |
irssiUbuntu:14.04:LTS |
before 0.8.15-5ubuntu3.2, plus listed versions 0.8.15-5ubuntu20.8.15-5ubuntu30.8.15-5ubuntu3.1 |
0.8.15-5ubuntu3.2 |
irssiUbuntu:16.04:LTS |
before 0.8.19-1ubuntu1.4, plus listed versions 0.8.17-1ubuntu10.8.17-1ubuntu20.8.18-1ubuntu10.8.19-1ubuntu10.8.19-1ubuntu1.20.8.19-1ubuntu1.3 |
0.8.19-1ubuntu1.4 |
irssiSUSE:Package Hub 12 |
before 1.0.3-25.1 | 1.0.3-25.1 |
irssiopenSUSE:Tumbleweed |
before 1.2.3-2.4 | 1.2.3-2.4 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2017-9469 is a high vulnerability (CVSS 7.5) in Irssi, published June 6, 2017. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 6.08%, the 93rd percentile. Fixed in irssi 1.0.3-r0.
References
debian.org/security/2017/dsa-3885
openwall.com/lists/oss-security/2017/06/06/4
irssi.org/security/irssi_sa_2017_06.txt
securityfocus.com/bid/99043
securitytracker.com/id/1038621
nvd.nist.gov/vuln/detail/CVE-2017-9469
Show 38 moreShow less
github.com/advisories/GHSA-4fcw-x547-92cj
security.alpinelinux.org/vuln/CVE-2017-9469
security-tracker.debian.org/tracker/CVE-2017-9469
advisories.mageia.org/MGASA-2017-0185.html
bugs.mageia.org/show_bug.cgi?id=21037
ubuntu.com/usn/usn-3317-1
ubuntu.com/security/CVE-2017-9469
cve.org/CVERecord?id=CVE-2017-9469
bugzilla.suse.com/1043051
suse.com/security/cve/CVE-2017-9468