{"id":"CVE-2017-10965","aliases":["ALPINE-CVE-2017-10965","DEBIAN-CVE-2017-10965","DLA-1089-1","EUVD-2017-2603","GHSA-54h6-8x6r-vr9v","MGASA-2017-0216","UBUNTU-CVE-2017-10965","USN-3465-1","openSUSE-SU-2017:1823-1","openSUSE-SU-2017:1824-1","openSUSE-SU-2024:10865-1"],"status":"published","title":"An issue was discovered in Irssi before 1.0.4. When receiving messages with invalid time stamps,...","description":"An issue was discovered in Irssi before 1.0.4. When receiving messages with invalid time stamps, Irssi would try to dereference a NULL pointer.","severity":{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-07","score":0.03443,"percentile":0.8907,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-476"],"published":"2017-07-07T00:00:00Z","modified":"2026-10-20T10:47:29Z","fixes":[{"ecosystem":"Alpine:v3.10","package":"irssi","fixed_in":["1.0.4-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.11","package":"irssi","fixed_in":["1.0.4-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.12","package":"irssi","fixed_in":["1.0.4-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.13","package":"irssi","fixed_in":["1.0.4-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.14","package":"irssi","fixed_in":["1.0.4-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.15","package":"irssi","fixed_in":["1.0.4-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.16","package":"irssi","fixed_in":["1.0.4-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.17","package":"irssi","fixed_in":["1.0.4-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.3","package":"irssi","fixed_in":["0.8.21.r2"],"sources":["osv"]},{"ecosystem":"Alpine:v3.4","package":"irssi","fixed_in":["0.8.21.r2"],"sources":["osv"]},{"ecosystem":"Alpine:v3.5","package":"irssi","fixed_in":["0.8.21.r2"],"sources":["osv"]},{"ecosystem":"Alpine:v3.7","package":"irssi","fixed_in":["1.0.4-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.8","package":"irssi","fixed_in":["1.0.4-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.9","package":"irssi","fixed_in":["1.0.4-r0"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"irssi","fixed_in":["1.0.4-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"irssi","fixed_in":["1.0.4-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"irssi","fixed_in":["1.0.4-1"],"sources":["osv"]},{"ecosystem":"Ubuntu:14.04:LTS","package":"irssi","fixed_in":["0.8.15-5ubuntu3.3"],"sources":["osv"]},{"ecosystem":"Ubuntu:16.04:LTS","package":"irssi","fixed_in":["0.8.19-1ubuntu1.5"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.10","package":"irssi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.4-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.11","package":"irssi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.4-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.12","package":"irssi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.4-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.13","package":"irssi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.4-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.14","package":"irssi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.4-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.15","package":"irssi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.4-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.16","package":"irssi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.4-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.17","package":"irssi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.4-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.3","package":"irssi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.8.21.r2"}]}]},{"source":"osv","ecosystem":"Alpine:v3.4","package":"irssi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.8.21.r2"}]}]},{"source":"osv","ecosystem":"Alpine:v3.5","package":"irssi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.8.21.r2"}]}]},{"source":"osv","ecosystem":"Alpine:v3.7","package":"irssi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.4-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.8","package":"irssi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.4-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.9","package":"irssi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.4-r0"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"irssi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.4-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"irssi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.4-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"irssi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.4-1"}]}]},{"source":"osv","ecosystem":"Debian:7","package":"irssi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.8.15-5+deb7u3"}]}],"versions":["0.8.15-5","0.8.15-5+deb7u1","0.8.15-5+deb7u2"],"bundled":2},{"source":"osv","ecosystem":"Mageia:5","package":"irssi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.8.21-1.2.mga5"}]}],"bundled":2},{"source":"osv","ecosystem":"Mageia:6","package":"irssi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.4-1.mga6"}]}],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"irssi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.8.15-5ubuntu3.3"}]}],"versions":["0.8.15-5ubuntu2","0.8.15-5ubuntu3","0.8.15-5ubuntu3.1","0.8.15-5ubuntu3.2"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"irssi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.8.19-1ubuntu1.5"}]}],"versions":["0.8.17-1ubuntu1","0.8.17-1ubuntu2","0.8.18-1ubuntu1","0.8.19-1ubuntu1","0.8.19-1ubuntu1.2","0.8.19-1ubuntu1.3","0.8.19-1ubuntu1.4"]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"irssi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.8.15-5ubuntu3.3"}]}],"versions":["0.8.15-5ubuntu2","0.8.15-5ubuntu3","0.8.15-5ubuntu3.1","0.8.15-5ubuntu3.2"],"bundled":7},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"irssi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.8.19-1ubuntu1.5"}]}],"versions":["0.8.17-1ubuntu1","0.8.17-1ubuntu2","0.8.18-1ubuntu1","0.8.19-1ubuntu1","0.8.19-1ubuntu1.2","0.8.19-1ubuntu1.3","0.8.19-1ubuntu1.4"],"bundled":7},{"source":"osv","ecosystem":"SUSE:Package Hub 12","package":"irssi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.4-28.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Package Hub 12","package":"irssi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.4-28.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"irssi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.3-2.4"}]}],"bundled":26}],"products":[{"vendor":"irssi","product":"irssi"}],"references":[{"url":"https://www.debian.org/security/2017/dsa-4016","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","advisory"]},{"url":"https://irssi.org/security/irssi_sa_2017_07.txt","tags":["x_refsource_CONFIRM","x_transferred","Patch","Vendor Advisory","fix","report"]},{"url":"https://github.com/irssi/irssi/commit/5e26325317c72a04c1610ad952974e206384d291","tags":["x_refsource_CONFIRM","x_transferred","Issue Tracking","Patch","Third Party Advisory","fix"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-10965"},{"url":"https://github.com/advisories/GHSA-54h6-8x6r-vr9v"},{"url":"https://security.alpinelinux.org/vuln/CVE-2017-10965","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2017-10965","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2017-0216.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=21199","tags":["report"]},{"url":"https://lists.opensuse.org/opensuse-updates/2017-07/msg00044.html","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2017-10965","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-3465-1","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2017-10965","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-10966","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-15227","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-15228","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-15721","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-15722","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-15723","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1047709","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2017-10965","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-10966","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-15227","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-15228","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-15721","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-15722","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-15723","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-5193","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-5194","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-5195","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-5196","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-5356","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-9468","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-9469","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-5205","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-5206","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-5207","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-5208","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-7050","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-7051","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-7052","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-7053","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-7054","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-13045","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-15717","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-5882","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2017-10965","description":"An issue was discovered in Irssi before 1.0.4. When receiving messages with invalid time stamps, Irssi would try to dereference a NULL pointer.","status":"published","published":"2017-07-07T14:00:00Z","modified":"2024-08-05T17:57:56.737Z","updated_at":"2026-11-02T14:33:12.942409Z"}],"euvd":[{"id":"EUVD-2017-2603","description":"An issue was discovered in Irssi before 1.0.4. When receiving messages with invalid time stamps, Irssi would try to dereference a NULL pointer.","status":"published","published":"2017-07-07T14:00:00Z","modified":"2024-08-05T17:57:56Z","updated_at":"2026-11-03T02:23:24.743229Z"}],"ghsa":[{"id":"GHSA-54h6-8x6r-vr9v","title":"An issue was discovered in Irssi before 1.0.4. When receiving messages with invalid time stamps,...","description":"An issue was discovered in Irssi before 1.0.4. When receiving messages with invalid time stamps, Irssi would try to dereference a NULL pointer.","status":"published","published":"2022-05-17T00:26:31Z","modified":"2023-02-03T05:01:42Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-476"],"updated_at":"2026-11-02T14:53:01.625617Z"}],"nvd":[{"id":"CVE-2017-10965","description":"An issue was discovered in Irssi before 1.0.4. When receiving messages with invalid time stamps, Irssi would try to dereference a NULL pointer.","status":"published","published":"2017-07-07T14:29:00.283Z","modified":"2026-06-17T01:01:00.327Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"},{"version":"2.0","score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","level":"high","assessor":"primary"}],"cwes":["CWE-476"],"updated_at":"2026-11-02T14:03:54.012105Z"}],"osv":[{"id":"ALPINE-CVE-2017-10965","description":"An issue was discovered in Irssi before 1.0.4. When receiving messages with invalid time stamps, Irssi would try to dereference a NULL pointer.","status":"published","published":"2017-07-07T14:29:00.283Z","modified":"2026-06-15T18:23:58.008655679Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:27:46.716249Z"},{"id":"CVE-2017-10965","description":"An issue was discovered in Irssi before 1.0.4. When receiving messages with invalid time stamps, Irssi would try to dereference a NULL pointer.","status":"published","published":"2017-07-07T14:29:00.283Z","modified":"2026-10-20T10:47:29.39804874Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:44:03.851821Z"},{"id":"DEBIAN-CVE-2017-10965","description":"An issue was discovered in Irssi before 1.0.4. When receiving messages with invalid time stamps, Irssi would try to dereference a NULL pointer.","status":"published","published":"2017-07-07T14:29:00.283Z","modified":"2026-09-01T20:03:40.901588259Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:45:28.50097Z"},{"id":"UBUNTU-CVE-2017-10965","description":"An issue was discovered in Irssi before 1.0.4. When receiving messages with invalid time stamps, Irssi would try to dereference a NULL pointer.","status":"published","published":"2017-07-07T00:00:00Z","modified":"2026-04-22T11:10:15.173443Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:54:13.729565Z"},{"id":"DLA-1089-1","title":"irssi - security update","status":"published","published":"2017-09-05T00:00:00Z","modified":"2026-03-09T01:01:52.048509Z","updated_at":"2026-11-02T15:46:09.336894Z"},{"id":"MGASA-2017-0216","title":"Updated irssi packages fix security vulnerabilities","description":"A malicious server could cause irssi to crash by providing an invalid\ntimestamp (CVE-2017-10965).\n\nUndefined behavior may be triggered when irssi updates the internal nick\nlist (CVE-2017-10966).\n","status":"published","published":"2017-07-24T21:45:38Z","modified":"2026-04-16T06:24:21.497424238Z","updated_at":"2026-11-02T15:49:40.103088Z"},{"id":"openSUSE-SU-2017:1823-1","title":"Security update for irssi","description":"This update for irssi to version fixes the following issues:\n\n- CVE-2017-10965: A malicious server could cause irssi to crash by providing an invalid timestamp\n- CVE-2017-10966: Undefined behavior may be triggered when irssi updates the internal nick list\n\nA number of minor upstream bug fixes are also included.\n","status":"published","published":"2017-07-07T23:03:39Z","modified":"2025-05-07T18:09:29.664728Z","updated_at":"2026-11-02T16:58:30.39372Z"},{"id":"openSUSE-SU-2017:1824-1","title":"Security update for irssi","description":"This update for irssi to version fixes the following issues:\n\n- CVE-2017-10965: A malicious server could cause irssi to crash by providing an invalid timestamp\n- CVE-2017-10966: Undefined behavior may be triggered when irssi updates the internal nick list\n\nA number of minor upstream bug fixes are also included.\n","status":"published","published":"2017-07-07T23:03:39Z","modified":"2026-02-04T02:20:20.124105Z","updated_at":"2026-11-02T16:58:30.39372Z"},{"id":"openSUSE-SU-2024:10865-1","title":"irssi-1.2.3-2.4 on GA media","description":"These are all security issues fixed in the irssi-1.2.3-2.4 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T04:27:28.449384Z","updated_at":"2026-11-02T16:58:34.894275Z"},{"id":"USN-3465-1","title":"irssi vulnerabilities","description":"Brian Carpenter discovered that Irssi incorrectly handled messages with\ninvalid time stamps. A malicious IRC server could use this issue to cause\nIrssi to crash, resulting in a denial of service. (CVE-2017-10965)\n\nBrian Carpenter discovered that Irssi incorrectly handled the internal nick\nlist. A malicious IRC server could use this issue to cause Irssi to crash,\nresulting in a denial of service. (CVE-2017-10966)\n\nJoseph Bisch discovered that Irssi incorrectly removed destroyed channels\nfrom the query list. A malicious IRC server could use this issue to cause\nIrssi to crash, resulting in a denial of service. (CVE-2017-15227)\n\nHanno Böck discovered that Irssi incorrectly handled themes. If a user were\ntricked into using a malicious theme, a attacker could use this issue to\ncause Irssi to crash, resulting in a denial of service. (CVE-2017-15228)\n\nJoseph Bisch discovered that Irssi incorrectly handled certain DCC CTCP\nmessages. A malicious IRC server could use this issue to cause Irssi to\ncrash, resulting in a denial of service. (CVE-2017-15721)\n\nJoseph Bisch discovered that Irssi incorrectly handled certain channel IDs.\nA malicious IRC server could use this issue to cause Irssi to crash,\nresulting in a denial of service. (CVE-2017-15722)\n\nJoseph Bisch discovered that Irssi incorrectly handled certain long nicks\nor targets. A malicious IRC server could use this issue to cause Irssi to\ncrash, resulting in a denial of service. (CVE-2017-15723)\n","status":"published","published":"2017-10-26T17:09:16Z","modified":"2026-04-22T09:40:20.274671Z","updated_at":"2026-11-02T16:58:13.496563Z"}]}}