CVE-2018-5208

In Irssi before 1.0.6, a calculation error in the completion code could cause a heap buffer overflow when completing certain strings.

In Irssi before 1.0.6, a calculation error in the completion code could cause a heap buffer overflow when completing certain strings.

Joseph Bisch discovered that Irssi incorrectly handled incomplete escape codes. If a user were tricked into using malformed commands or opening malformed files, an attacker could use this issue to cause Irssi to crash, resulting in a denial of service (CVE-2018-5205).

Joseph Bisch discovered that Irssi incorrectly handled settings the channel topic without specifying a sender. A malicious IRC server could use this issue to cause Irssi to crash, resulting in a denial of service (CVE-2018-5206).

Joseph Bisch discovered that Irssi incorrectly handled incomplete variable arguments. If a user were tricked into using malformed commands or opening malformed files, an attacker could use this issue to cause Irssi to crash, resulting in a denial of service (CVE-2018-5207).

Joseph Bisch discovered that Irssi incorrectly handled completing certain strings. An attacker could use this issue to cause Irssi to crash, resulting in a denial of service, or possibly execute arbitrary code (CVE-2018-5208).

This update for irssi to version 1.0.6 fixes several issues that may affect the stability of irssi:

• CVE-2018-5205: Data access beyond the end of the string when using incomplete escape codes
• CVE-2018-5206: NULL pointer dereference when the channel topic is set without specifying a sender
• CVE-2018-5207: When using an incomplete variable argument, Irssi may access data beyond the end of the string
• CVE-2018-5208: Heap buffer overflow when completing certain strings

This update for irssi to version 1.0.6 fixes several issues that may affect the stability of irssi:

• CVE-2018-5205: Data access beyond the end of the string when using incomplete escape codes
• CVE-2018-5206: NULL pointer dereference when the channel topic is set without specifying a sender
• CVE-2018-5207: When using an incomplete variable argument, Irssi may access data beyond the end of the string
• CVE-2018-5208: Heap buffer overflow when completing certain strings

These are all security issues fixed in the irssi-1.2.3-2.4 package on the GA media of openSUSE Tumbleweed.

Joseph Bisch discovered that Irssi incorrectly handled incomplete escape codes. If a user were tricked into using malformed commands or opening malformed files, an attacker could use this issue to cause Irssi to crash, resulting in a denial of service. (CVE-2018-5205)

Joseph Bisch discovered that Irssi incorrectly handled settings the channel topic without specifying a sender. A malicious IRC server could use this issue to cause Irssi to crash, resulting in a denial of service. (CVE-2018-5206)

Joseph Bisch discovered that Irssi incorrectly handled incomplete variable arguments. If a user were tricked into using malformed commands or opening malformed files, an attacker could use this issue to cause Irssi to crash, resulting in a denial of service. (CVE-2018-5207)

Joseph Bisch discovered that Irssi incorrectly handled completing certain strings. An attacker could use this issue to cause Irssi to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2018-5208)