{"id":"CVE-2017-10966","aliases":["ALPINE-CVE-2017-10966","DEBIAN-CVE-2017-10966","DLA-1089-1","EUVD-2017-2604","GHSA-3jw8-77gg-583w","MGASA-2017-0216","UBUNTU-CVE-2017-10966","USN-3465-1","openSUSE-SU-2017:1823-1","openSUSE-SU-2017:1824-1","openSUSE-SU-2024:10865-1"],"status":"published","title":"An issue was discovered in Irssi before 1.0.4. While updating the internal nick list, Irssi could...","description":"An issue was discovered in Irssi before 1.0.4. While updating the internal nick list, Irssi could incorrectly use the GHashTable interface and free the nick while updating it. This would then result in use-after-free conditions on each access of the hash table.","severity":{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.02935,"percentile":0.87187,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-416"],"published":"2017-07-07T00:00:00Z","modified":"2026-10-20T10:48:07Z","fixes":[{"ecosystem":"Alpine:v3.10","package":"irssi","fixed_in":["1.0.4-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.11","package":"irssi","fixed_in":["1.0.4-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.12","package":"irssi","fixed_in":["1.0.4-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.13","package":"irssi","fixed_in":["1.0.4-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.14","package":"irssi","fixed_in":["1.0.4-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.15","package":"irssi","fixed_in":["1.0.4-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.16","package":"irssi","fixed_in":["1.0.4-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.17","package":"irssi","fixed_in":["1.0.4-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.3","package":"irssi","fixed_in":["0.8.21.r2"],"sources":["osv"]},{"ecosystem":"Alpine:v3.4","package":"irssi","fixed_in":["0.8.21.r2"],"sources":["osv"]},{"ecosystem":"Alpine:v3.5","package":"irssi","fixed_in":["0.8.21.r2"],"sources":["osv"]},{"ecosystem":"Alpine:v3.7","package":"irssi","fixed_in":["1.0.4-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.8","package":"irssi","fixed_in":["1.0.4-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.9","package":"irssi","fixed_in":["1.0.4-r0"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"irssi","fixed_in":["1.0.4-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"irssi","fixed_in":["1.0.4-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"irssi","fixed_in":["1.0.4-1"],"sources":["osv"]},{"ecosystem":"Ubuntu:14.04:LTS","package":"irssi","fixed_in":["0.8.15-5ubuntu3.3"],"sources":["osv"]},{"ecosystem":"Ubuntu:16.04:LTS","package":"irssi","fixed_in":["0.8.19-1ubuntu1.5"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.10","package":"irssi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.4-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.11","package":"irssi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.4-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.12","package":"irssi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.4-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.13","package":"irssi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.4-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.14","package":"irssi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.4-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.15","package":"irssi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.4-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.16","package":"irssi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.4-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.17","package":"irssi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.4-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.3","package":"irssi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.8.21.r2"}]}]},{"source":"osv","ecosystem":"Alpine:v3.4","package":"irssi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.8.21.r2"}]}]},{"source":"osv","ecosystem":"Alpine:v3.5","package":"irssi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.8.21.r2"}]}]},{"source":"osv","ecosystem":"Alpine:v3.7","package":"irssi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.4-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.8","package":"irssi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.4-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.9","package":"irssi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.4-r0"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"irssi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.4-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"irssi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.4-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"irssi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.4-1"}]}]},{"source":"osv","ecosystem":"Debian:7","package":"irssi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.8.15-5+deb7u3"}]}],"versions":["0.8.15-5","0.8.15-5+deb7u1","0.8.15-5+deb7u2"],"bundled":2},{"source":"osv","ecosystem":"Mageia:5","package":"irssi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.8.21-1.2.mga5"}]}],"bundled":2},{"source":"osv","ecosystem":"Mageia:6","package":"irssi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.4-1.mga6"}]}],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"irssi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.8.15-5ubuntu3.3"}]}],"versions":["0.8.15-5ubuntu2","0.8.15-5ubuntu3","0.8.15-5ubuntu3.1","0.8.15-5ubuntu3.2"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"irssi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.8.19-1ubuntu1.5"}]}],"versions":["0.8.17-1ubuntu1","0.8.17-1ubuntu2","0.8.18-1ubuntu1","0.8.19-1ubuntu1","0.8.19-1ubuntu1.2","0.8.19-1ubuntu1.3","0.8.19-1ubuntu1.4"]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"irssi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.8.15-5ubuntu3.3"}]}],"versions":["0.8.15-5ubuntu2","0.8.15-5ubuntu3","0.8.15-5ubuntu3.1","0.8.15-5ubuntu3.2"],"bundled":7},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"irssi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.8.19-1ubuntu1.5"}]}],"versions":["0.8.17-1ubuntu1","0.8.17-1ubuntu2","0.8.18-1ubuntu1","0.8.19-1ubuntu1","0.8.19-1ubuntu1.2","0.8.19-1ubuntu1.3","0.8.19-1ubuntu1.4"],"bundled":7},{"source":"osv","ecosystem":"SUSE:Package Hub 12","package":"irssi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.4-28.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Package Hub 12","package":"irssi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.4-28.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"irssi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.3-2.4"}]}],"bundled":26}],"products":[{"vendor":"irssi","product":"irssi"}],"references":[{"url":"https://www.debian.org/security/2017/dsa-4016","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","advisory"]},{"url":"https://irssi.org/security/irssi_sa_2017_07.txt","tags":["x_refsource_CONFIRM","x_transferred","Patch","Vendor Advisory","fix","report"]},{"url":"https://github.com/irssi/irssi/commit/5e26325317c72a04c1610ad952974e206384d291","tags":["x_refsource_CONFIRM","x_transferred","Issue Tracking","Patch","Third Party Advisory","fix"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-10966"},{"url":"https://github.com/advisories/GHSA-3jw8-77gg-583w"},{"url":"https://security.alpinelinux.org/vuln/CVE-2017-10966","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2017-10966","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2017-0216.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=21199","tags":["report"]},{"url":"https://lists.opensuse.org/opensuse-updates/2017-07/msg00044.html","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2017-10966","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-3465-1","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2017-10966","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-10965","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-15227","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-15228","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-15721","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-15722","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-15723","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1047709","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2017-10965","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-10966","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-15227","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-15228","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-15721","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-15722","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-15723","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-5193","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-5194","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-5195","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-5196","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-5356","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-9468","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-9469","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-5205","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-5206","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-5207","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-5208","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-7050","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-7051","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-7052","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-7053","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-7054","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-13045","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-15717","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-5882","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2017-10966","description":"An issue was discovered in Irssi before 1.0.4. While updating the internal nick list, Irssi could incorrectly use the GHashTable interface and free the nick while updating it. This would then result in use-after-free conditions on each access of the hash table.","status":"published","published":"2017-07-07T14:00:00Z","modified":"2024-08-05T17:57:56.715Z","updated_at":"2026-11-02T14:33:13.27226Z"}],"euvd":[{"id":"EUVD-2017-2604","description":"An issue was discovered in Irssi before 1.0.4. While updating the internal nick list, Irssi could incorrectly use the GHashTable interface and free the nick while updating it. This would then result in use-after-free conditions on each access of the hash table.","status":"published","published":"2017-07-07T14:00:00Z","modified":"2024-08-05T17:57:56Z","updated_at":"2026-11-03T02:23:24.743229Z"}],"ghsa":[{"id":"GHSA-3jw8-77gg-583w","title":"An issue was discovered in Irssi before 1.0.4. While updating the internal nick list, Irssi could...","description":"An issue was discovered in Irssi before 1.0.4. While updating the internal nick list, Irssi could incorrectly use the GHashTable interface and free the nick while updating it. This would then result in use-after-free conditions on each access of the hash table.","status":"published","published":"2022-05-17T00:26:31Z","modified":"2023-02-03T05:01:42Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-416"],"updated_at":"2026-11-02T14:53:01.625617Z"}],"nvd":[{"id":"CVE-2017-10966","description":"An issue was discovered in Irssi before 1.0.4. While updating the internal nick list, Irssi could incorrectly use the GHashTable interface and free the nick while updating it. This would then result in use-after-free conditions on each access of the hash table.","status":"published","published":"2017-07-07T14:29:00.36Z","modified":"2026-06-17T01:01:00.46Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"},{"version":"2.0","score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","level":"high","assessor":"primary"}],"cwes":["CWE-416"],"updated_at":"2026-11-02T14:03:54.012105Z"}],"osv":[{"id":"ALPINE-CVE-2017-10966","description":"An issue was discovered in Irssi before 1.0.4. While updating the internal nick list, Irssi could incorrectly use the GHashTable interface and free the nick while updating it. This would then result in use-after-free conditions on each access of the hash table.","status":"published","published":"2017-07-07T14:29:00.36Z","modified":"2026-06-15T18:23:58.962506382Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:27:46.716249Z"},{"id":"CVE-2017-10966","description":"An issue was discovered in Irssi before 1.0.4. While updating the internal nick list, Irssi could incorrectly use the GHashTable interface and free the nick while updating it. This would then result in use-after-free conditions on each access of the hash table.","status":"published","published":"2017-07-07T14:29:00.36Z","modified":"2026-10-20T10:48:07.858014723Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:44:03.851821Z"},{"id":"DEBIAN-CVE-2017-10966","description":"An issue was discovered in Irssi before 1.0.4. While updating the internal nick list, Irssi could incorrectly use the GHashTable interface and free the nick while updating it. This would then result in use-after-free conditions on each access of the hash table.","status":"published","published":"2017-07-07T14:29:00.36Z","modified":"2026-09-01T20:03:40.915138955Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:45:28.50097Z"},{"id":"UBUNTU-CVE-2017-10966","description":"An issue was discovered in Irssi before 1.0.4. While updating the internal nick list, Irssi could incorrectly use the GHashTable interface and free the nick while updating it. This would then result in use-after-free conditions on each access of the hash table.","status":"published","published":"2017-07-07T00:00:00Z","modified":"2026-04-22T11:10:25.401968Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:54:13.729565Z"},{"id":"DLA-1089-1","title":"irssi - security update","status":"published","published":"2017-09-05T00:00:00Z","modified":"2026-03-09T01:01:52.048509Z","updated_at":"2026-11-02T15:46:09.336894Z"},{"id":"MGASA-2017-0216","title":"Updated irssi packages fix security vulnerabilities","description":"A malicious server could cause irssi to crash by providing an invalid\ntimestamp (CVE-2017-10965).\n\nUndefined behavior may be triggered when irssi updates the internal nick\nlist (CVE-2017-10966).\n","status":"published","published":"2017-07-24T21:45:38Z","modified":"2026-04-16T06:24:21.497424238Z","updated_at":"2026-11-02T15:49:40.103088Z"},{"id":"openSUSE-SU-2017:1823-1","title":"Security update for irssi","description":"This update for irssi to version fixes the following issues:\n\n- CVE-2017-10965: A malicious server could cause irssi to crash by providing an invalid timestamp\n- CVE-2017-10966: Undefined behavior may be triggered when irssi updates the internal nick list\n\nA number of minor upstream bug fixes are also included.\n","status":"published","published":"2017-07-07T23:03:39Z","modified":"2025-05-07T18:09:29.664728Z","updated_at":"2026-11-02T16:58:30.39372Z"},{"id":"openSUSE-SU-2017:1824-1","title":"Security update for irssi","description":"This update for irssi to version fixes the following issues:\n\n- CVE-2017-10965: A malicious server could cause irssi to crash by providing an invalid timestamp\n- CVE-2017-10966: Undefined behavior may be triggered when irssi updates the internal nick list\n\nA number of minor upstream bug fixes are also included.\n","status":"published","published":"2017-07-07T23:03:39Z","modified":"2026-02-04T02:20:20.124105Z","updated_at":"2026-11-02T16:58:30.39372Z"},{"id":"openSUSE-SU-2024:10865-1","title":"irssi-1.2.3-2.4 on GA media","description":"These are all security issues fixed in the irssi-1.2.3-2.4 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T04:27:28.449384Z","updated_at":"2026-11-02T16:58:34.894275Z"},{"id":"USN-3465-1","title":"irssi vulnerabilities","description":"Brian Carpenter discovered that Irssi incorrectly handled messages with\ninvalid time stamps. A malicious IRC server could use this issue to cause\nIrssi to crash, resulting in a denial of service. (CVE-2017-10965)\n\nBrian Carpenter discovered that Irssi incorrectly handled the internal nick\nlist. A malicious IRC server could use this issue to cause Irssi to crash,\nresulting in a denial of service. (CVE-2017-10966)\n\nJoseph Bisch discovered that Irssi incorrectly removed destroyed channels\nfrom the query list. A malicious IRC server could use this issue to cause\nIrssi to crash, resulting in a denial of service. (CVE-2017-15227)\n\nHanno Böck discovered that Irssi incorrectly handled themes. If a user were\ntricked into using a malicious theme, a attacker could use this issue to\ncause Irssi to crash, resulting in a denial of service. (CVE-2017-15228)\n\nJoseph Bisch discovered that Irssi incorrectly handled certain DCC CTCP\nmessages. A malicious IRC server could use this issue to cause Irssi to\ncrash, resulting in a denial of service. (CVE-2017-15721)\n\nJoseph Bisch discovered that Irssi incorrectly handled certain channel IDs.\nA malicious IRC server could use this issue to cause Irssi to crash,\nresulting in a denial of service. (CVE-2017-15722)\n\nJoseph Bisch discovered that Irssi incorrectly handled certain long nicks\nor targets. A malicious IRC server could use this issue to cause Irssi to\ncrash, resulting in a denial of service. (CVE-2017-15723)\n","status":"published","published":"2017-10-26T17:09:16Z","modified":"2026-04-22T09:40:20.274671Z","updated_at":"2026-11-02T16:58:13.496563Z"}]}}