{"id":"CVE-2017-5195","aliases":["ALPINE-CVE-2017-5195","DEBIAN-CVE-2017-5195","EUVD-2017-14303","GHSA-p9h4-9565-9j42","MGASA-2017-0018","UBUNTU-CVE-2017-5195","USN-3184-1","openSUSE-SU-2017:0093-1","openSUSE-SU-2017:0094-1","openSUSE-SU-2024:10865-1"],"status":"published","title":"Irssi 0.8.17 before 0.8.21 allows remote attackers to cause a denial of service (out-of-bounds...","description":"Irssi 0.8.17 before 0.8.21 allows remote attackers to cause a denial of service (out-of-bounds read and crash) via a crafted ANSI x8 color code.","severity":{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.05479,"percentile":0.92816,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-125"],"published":"2017-01-06T00:00:00Z","modified":"2026-10-24T10:30:17Z","fixes":[{"ecosystem":"Alpine:v3.2","package":"irssi","fixed_in":["0.8.21-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.3","package":"irssi","fixed_in":["0.8.21-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.4","package":"irssi","fixed_in":["0.8.21-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.5","package":"irssi","fixed_in":["0.8.21-r0"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"irssi","fixed_in":["0.8.21-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"irssi","fixed_in":["0.8.21-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"irssi","fixed_in":["0.8.21-1"],"sources":["osv"]},{"ecosystem":"Ubuntu:16.04:LTS","package":"irssi","fixed_in":["0.8.19-1ubuntu1.3"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.2","package":"irssi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.8.17"},{"fixed":"0.8.21-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.3","package":"irssi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.8.17"},{"fixed":"0.8.21-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.4","package":"irssi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.8.17"},{"fixed":"0.8.21-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.5","package":"irssi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.8.17"},{"fixed":"0.8.21-r0"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"irssi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.8.21-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"irssi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.8.21-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"irssi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.8.21-1"}]}]},{"source":"osv","ecosystem":"Mageia:5","package":"irssi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.8.21-1.mga5"}]}],"bundled":5},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"irssi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.8.19-1ubuntu1.3"}]}],"versions":["0.8.17-1ubuntu1","0.8.17-1ubuntu2","0.8.18-1ubuntu1","0.8.19-1ubuntu1","0.8.19-1ubuntu1.2"]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"irssi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.8.15-5ubuntu3.1"}]}],"versions":["0.8.15-5ubuntu2","0.8.15-5ubuntu3"],"bundled":6},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"irssi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.8.19-1ubuntu1.3"}]}],"versions":["0.8.17-1ubuntu1","0.8.17-1ubuntu2","0.8.18-1ubuntu1","0.8.19-1ubuntu1","0.8.19-1ubuntu1.2"],"bundled":6},{"source":"osv","ecosystem":"SUSE:Package Hub 12","package":"irssi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.8.21-12.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Package Hub 12","package":"irssi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.8.21-12.1"}]}],"bundled":4},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"irssi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.3-2.4"}]}],"bundled":26}],"products":[{"vendor":"irssi","product":"irssi"}],"references":[{"url":"http://www.openwall.com/lists/oss-security/2017/01/06/1","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"https://irssi.org/security/irssi_sa_2017_01.txt","tags":["x_refsource_CONFIRM","x_transferred","Patch","Vendor Advisory","fix","web","report"]},{"url":"http://www.securityfocus.com/bid/95310","tags":["vdb-entry","x_refsource_BID","x_transferred","Issue Tracking","Third Party Advisory","VDB Entry","report"]},{"url":"https://security.gentoo.org/glsa/201701-45","tags":["vendor-advisory","x_refsource_GENTOO","x_transferred","Third Party Advisory","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-5195"},{"url":"https://github.com/advisories/GHSA-p9h4-9565-9j42"},{"url":"https://security.alpinelinux.org/vuln/CVE-2017-5195","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2017-5195","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2017-0018.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=20078","tags":["report"]},{"url":"https://irssi.org/2017/01/05/irssi-0.8.21-released/","tags":["web"]},{"url":"http://openwall.com/lists/oss-security/2017/01/13/2","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2017-5195","tags":["report"]},{"url":"http://www.openwall.com/lists/oss-security/2017/01/05/2","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-3184-1","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2017-5195","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2016-7553","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-5193","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-5194","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-5196","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-5356","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1018357","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2017-5193","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-5194","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-5195","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-5196","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-10965","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-10966","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-15227","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-15228","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-15721","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-15722","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-15723","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-5356","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-9468","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-9469","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-5205","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-5206","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-5207","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-5208","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-7050","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-7051","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-7052","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-7053","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-7054","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-13045","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-15717","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-5882","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2017-5195","description":"Irssi 0.8.17 before 0.8.21 allows remote attackers to cause a denial of service (out-of-bounds read and crash) via a crafted ANSI x8 color code.","status":"published","published":"2017-03-03T15:00:00Z","modified":"2024-08-05T14:55:35.692Z","updated_at":"2026-11-02T14:33:12.942409Z"}],"euvd":[{"id":"EUVD-2017-14303","description":"Irssi 0.8.17 before 0.8.21 allows remote attackers to cause a denial of service (out-of-bounds read and crash) via a crafted ANSI x8 color code.","status":"published","published":"2017-03-03T15:00:00Z","modified":"2024-08-05T14:55:35Z","updated_at":"2026-11-03T02:39:16.415448Z"}],"ghsa":[{"id":"GHSA-p9h4-9565-9j42","title":"Irssi 0.8.17 before 0.8.21 allows remote attackers to cause a denial of service (out-of-bounds...","description":"Irssi 0.8.17 before 0.8.21 allows remote attackers to cause a denial of service (out-of-bounds read and crash) via a crafted ANSI x8 color code.","status":"published","published":"2022-05-14T01:19:31Z","modified":"2023-02-02T05:03:41Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-125"],"updated_at":"2026-11-02T14:51:41.689943Z"}],"nvd":[{"id":"CVE-2017-5195","description":"Irssi 0.8.17 before 0.8.21 allows remote attackers to cause a denial of service (out-of-bounds read and crash) via a crafted ANSI x8 color code.","status":"published","published":"2017-03-03T15:59:00.757Z","modified":"2026-06-17T01:20:08.277Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-125"],"updated_at":"2026-11-02T14:03:43.325192Z"}],"osv":[{"id":"ALPINE-CVE-2017-5195","description":"Irssi 0.8.17 before 0.8.21 allows remote attackers to cause a denial of service (out-of-bounds read and crash) via a crafted ANSI x8 color code.","status":"published","published":"2017-03-03T15:59:00.757Z","modified":"2026-07-08T04:31:08.284680728Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:27:46.716249Z"},{"id":"CVE-2017-5195","description":"Irssi 0.8.17 before 0.8.21 allows remote attackers to cause a denial of service (out-of-bounds read and crash) via a crafted ANSI x8 color code.","status":"published","published":"2017-03-03T15:59:00.757Z","modified":"2026-10-24T10:30:17.373830834Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:06.029968Z"},{"id":"DEBIAN-CVE-2017-5195","description":"Irssi 0.8.17 before 0.8.21 allows remote attackers to cause a denial of service (out-of-bounds read and crash) via a crafted ANSI x8 color code.","status":"published","published":"2017-03-03T15:59:00.757Z","modified":"2026-09-01T20:02:42.253345593Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:29.100767Z"},{"id":"UBUNTU-CVE-2017-5195","description":"Irssi 0.8.17 before 0.8.21 allows remote attackers to cause a denial of service (out-of-bounds read and crash) via a crafted ANSI x8 color code.","status":"published","published":"2017-01-06T00:00:00Z","modified":"2026-04-22T11:27:00.630009Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:54:15.388065Z"},{"id":"MGASA-2017-0018","title":"Updated irssi packages fix security vulnerabilities","description":"In irssi before 0.8.21, a NULL pointer dereference in the nickcmp\nfunction (CVE-2017-5193).\n\nIn irssi before 0.8.21, use after free when receiving invalid nick\nmessage (CVE-2017-5194).\n\nIn irssi before 0.8.21, out of bounds read in certain incomplete control\ncodes (CVE-2017-5195).\n\nIn irssi before 0.8.21, out of bounds read in certain incomplete\ncharacter sequences (CVE-2017-5196).\n\nIn irssi before 0.8.21, out of bounds read when printing certain values\n(CVE-2017-5356).\n","status":"published","published":"2017-01-14T21:05:17Z","modified":"2026-04-16T06:26:27.625019456Z","updated_at":"2026-11-02T15:49:40.103088Z"},{"id":"openSUSE-SU-2017:0093-1","title":"Security update for irssi","description":"irssi was updated to fix four vulnerabilities that could result in denial \nof service (remote crash) when connecting to malicious servers or receiving\nspecially crafted data. (boo#1018357)\n\n- CVE-2017-5193: NULL pointer dereference in the nickcmp function\n- CVE-2017-5194: out of bounds read in certain incomplete control codes\n- CVE-2017-5195: out of bounds read in certain incomplete character sequences \n- CVE-2017-5196: Correct an error when receiving invalid nick message","status":"published","published":"2017-01-09T16:14:54Z","modified":"2025-05-02T04:29:46.688164Z","updated_at":"2026-11-02T16:58:30.39372Z"},{"id":"openSUSE-SU-2017:0094-1","title":"Security update for irssi","description":"irssi was updated to fix four vulnerabilities that could result in denial \nof service (remote crash) when connecting to malicious servers or receiving\nspecially crafted data. (boo#1018357)\n\n- CVE-2017-5193: NULL pointer dereference in the nickcmp function\n- CVE-2017-5194: out of bounds read in certain incomplete control codes\n- CVE-2017-5195: out of bounds read in certain incomplete character sequences \n- CVE-2017-5196: Correct an error when receiving invalid nick message","status":"published","published":"2017-01-09T16:14:54Z","modified":"2026-02-04T04:27:00.564552Z","updated_at":"2026-11-02T16:58:30.39372Z"},{"id":"openSUSE-SU-2024:10865-1","title":"irssi-1.2.3-2.4 on GA media","description":"These are all security issues fixed in the irssi-1.2.3-2.4 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T04:27:28.449384Z","updated_at":"2026-11-02T16:58:34.894275Z"},{"id":"USN-3184-1","title":"irssi vulnerabilities","description":"It was discovered that the Irssi buf.pl script set incorrect permissions. A\nlocal attacker could use this issue to retrieve another user's window\ncontents. (CVE-2016-7553)\n\nJoseph Bisch discovered that Irssi incorrectly handled comparing nicks. A\nremote attacker could use this issue to cause Irssi to crash, resulting in\na denial of service, or possibly execute arbitrary code. (CVE-2017-5193)\n\nIt was discovered that Irssi incorrectly handled invalid nick messages. A\nremote attacker could use this issue to cause Irssi to crash, resulting in\na denial of service, or possibly execute arbitrary code. (CVE-2017-5194)\n\nJoseph Bisch discovered that Irssi incorrectly handled certain incomplete\ncontrol codes. A remote attacker could use this issue to cause Irssi to\ncrash, resulting in a denial of service, or possibly execute arbitrary\ncode. This issue only affected Ubuntu 16.04 LTS and Ubuntu 16.10.\n(CVE-2017-5195)\n\nHanno Böck and Joseph Bisch discovered that Irssi incorrectly handled\ncertain incomplete character sequences. A remote attacker could use this\nissue to cause Irssi to crash, resulting in a denial of service. This issue\nonly affected Ubuntu 16.04 LTS and Ubuntu 16.10. (CVE-2017-5196)\n\nHanno Böck discovered that Irssi incorrectly handled certain format\nstrings. A remote attacker could use this issue to cause Irssi to crash,\nresulting in a denial of service. (CVE-2017-5356)\n","status":"published","published":"2017-02-01T18:08:38Z","modified":"2026-04-22T09:31:51.901453Z","updated_at":"2026-11-02T16:58:10.303275Z"}]}}