{"id":"CVE-2017-5356","aliases":["ALPINE-CVE-2017-5356","DEBIAN-CVE-2017-5356","DLA-1217-1","EUVD-2017-14460","GHSA-rxfr-9cmv-jwxm","MGASA-2017-0018","UBUNTU-CVE-2017-5356","USN-3184-1","openSUSE-SU-2024:10865-1"],"status":"published","title":"Irssi before 0.8.21 allows remote attackers to cause a denial of service (out-of-bounds read and...","description":"Irssi before 0.8.21 allows remote attackers to cause a denial of service (out-of-bounds read and crash) via a string containing a formatting sequence (%[) without a closing bracket (]).","severity":{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.04779,"percentile":0.91979,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-125"],"published":"2017-01-13T00:00:00Z","modified":"2026-10-24T10:30:55Z","fixes":[{"ecosystem":"Alpine:v3.2","package":"irssi","fixed_in":["0.8.21-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.3","package":"irssi","fixed_in":["0.8.21-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.4","package":"irssi","fixed_in":["0.8.21-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.5","package":"irssi","fixed_in":["0.8.21-r0"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"irssi","fixed_in":["0.8.21-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"irssi","fixed_in":["0.8.21-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"irssi","fixed_in":["0.8.21-1"],"sources":["osv"]},{"ecosystem":"Ubuntu:14.04:LTS","package":"irssi","fixed_in":["0.8.15-5ubuntu3.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:16.04:LTS","package":"irssi","fixed_in":["0.8.19-1ubuntu1.3"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.2","package":"irssi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.8.21-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.3","package":"irssi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.8.21-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.4","package":"irssi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.8.21-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.5","package":"irssi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.8.21-r0"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"irssi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.8.21-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"irssi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.8.21-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"irssi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.8.21-1"}]}]},{"source":"osv","ecosystem":"Debian:7","package":"irssi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.8.15-5+deb7u4"}]}],"versions":["0.8.15-5","0.8.15-5+deb7u1","0.8.15-5+deb7u2","0.8.15-5+deb7u3"],"bundled":7},{"source":"osv","ecosystem":"Mageia:5","package":"irssi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.8.21-1.mga5"}]}],"bundled":5},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"irssi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.8.15-5ubuntu3.1"}]}],"versions":["0.8.15-5ubuntu2","0.8.15-5ubuntu3"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"irssi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.8.19-1ubuntu1.3"}]}],"versions":["0.8.17-1ubuntu1","0.8.17-1ubuntu2","0.8.18-1ubuntu1","0.8.19-1ubuntu1","0.8.19-1ubuntu1.2"]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"irssi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.8.15-5ubuntu3.1"}]}],"versions":["0.8.15-5ubuntu2","0.8.15-5ubuntu3"],"bundled":6},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"irssi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.8.19-1ubuntu1.3"}]}],"versions":["0.8.17-1ubuntu1","0.8.17-1ubuntu2","0.8.18-1ubuntu1","0.8.19-1ubuntu1","0.8.19-1ubuntu1.2"],"bundled":6},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"irssi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.3-2.4"}]}],"bundled":26}],"products":[{"vendor":"debian","product":"debian_linux"},{"vendor":"irssi","product":"irssi"}],"references":[{"url":"https://lists.debian.org/debian-lts-announce/2017/12/msg00022.html","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"http://www.securityfocus.com/bid/96581","tags":["vdb-entry","x_refsource_BID","x_transferred","Third Party Advisory","VDB Entry","advisory"]},{"url":"https://blog.fuzzing-project.org/55-Fuzzing-Irssi-with-Perl-Scripts.html","tags":["x_refsource_MISC","x_transferred","Exploit","Technical Description","Third Party Advisory","evidence","report"]},{"url":"https://irssi.org/security/irssi_sa_2017_01.txt","tags":["x_refsource_CONFIRM","x_transferred","Patch","Vendor Advisory","fix","web"]},{"url":"http://www.openwall.com/lists/oss-security/2017/01/12/8","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2017/01/13/2","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-5356"},{"url":"https://github.com/advisories/GHSA-rxfr-9cmv-jwxm"},{"url":"https://security.alpinelinux.org/vuln/CVE-2017-5356","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2017-5356","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2017-0018.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=20078","tags":["report"]},{"url":"https://irssi.org/2017/01/05/irssi-0.8.21-released/","tags":["web"]},{"url":"http://openwall.com/lists/oss-security/2017/01/13/2","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2017-5356","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-3184-1","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2017-5356","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2016-7553","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-5193","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-5194","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-5195","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-5196","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2017-10965","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-10966","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-15227","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-15228","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-15721","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-15722","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-15723","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-5193","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-5194","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-5195","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-5196","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-5356","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-9468","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-9469","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-5205","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-5206","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-5207","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-5208","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-7050","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-7051","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-7052","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-7053","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-7054","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-13045","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-15717","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-5882","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2017-5356","description":"Irssi before 0.8.21 allows remote attackers to cause a denial of service (out-of-bounds read and crash) via a string containing a formatting sequence (%[) without a closing bracket (]).","status":"published","published":"2017-03-03T15:00:00Z","modified":"2024-08-05T14:55:35.676Z","updated_at":"2026-11-02T14:33:12.599234Z"}],"euvd":[{"id":"EUVD-2017-14460","description":"Irssi before 0.8.21 allows remote attackers to cause a denial of service (out-of-bounds read and crash) via a string containing a formatting sequence (%[) without a closing bracket (]).","status":"published","published":"2017-03-03T15:00:00Z","modified":"2024-08-05T14:55:35Z","updated_at":"2026-11-03T02:39:15.955222Z"}],"ghsa":[{"id":"GHSA-rxfr-9cmv-jwxm","title":"Irssi before 0.8.21 allows remote attackers to cause a denial of service (out-of-bounds read and...","description":"Irssi before 0.8.21 allows remote attackers to cause a denial of service (out-of-bounds read and crash) via a string containing a formatting sequence (%[) without a closing bracket (]).","status":"published","published":"2022-05-14T01:20:03Z","modified":"2023-02-02T05:03:42Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-125"],"updated_at":"2026-11-02T14:51:41.689943Z"}],"nvd":[{"id":"CVE-2017-5356","description":"Irssi before 0.8.21 allows remote attackers to cause a denial of service (out-of-bounds read and crash) via a string containing a formatting sequence (%[) without a closing bracket (]).","status":"published","published":"2017-03-03T15:59:00.82Z","modified":"2026-06-17T01:20:19.07Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-125"],"updated_at":"2026-11-02T14:03:43.325192Z"}],"osv":[{"id":"ALPINE-CVE-2017-5356","description":"Irssi before 0.8.21 allows remote attackers to cause a denial of service (out-of-bounds read and crash) via a string containing a formatting sequence (%[) without a closing bracket (]).","status":"published","published":"2017-03-03T15:59:00.82Z","modified":"2026-06-15T18:24:09.616175954Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:27:46.716249Z"},{"id":"CVE-2017-5356","description":"Irssi before 0.8.21 allows remote attackers to cause a denial of service (out-of-bounds read and crash) via a string containing a formatting sequence (%[) without a closing bracket (]).","status":"published","published":"2017-03-03T15:59:00.82Z","modified":"2026-10-24T10:30:55.350910321Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:06.029968Z"},{"id":"DEBIAN-CVE-2017-5356","description":"Irssi before 0.8.21 allows remote attackers to cause a denial of service (out-of-bounds read and crash) via a string containing a formatting sequence (%[) without a closing bracket (]).","status":"published","published":"2017-03-03T15:59:00.82Z","modified":"2026-09-01T20:03:48.045312919Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:29.412243Z"},{"id":"UBUNTU-CVE-2017-5356","description":"Irssi before 0.8.21 allows remote attackers to cause a denial of service (out-of-bounds read and crash) via a string containing a formatting sequence (%[) without a closing bracket (]).","status":"published","published":"2017-01-13T00:00:00Z","modified":"2026-04-22T11:26:23.37455Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:54:15.388065Z"},{"id":"DLA-1217-1","title":"irssi - security update","status":"published","published":"2017-12-21T00:00:00Z","modified":"2026-03-09T01:01:48.756858Z","updated_at":"2026-11-02T15:46:09.336894Z"},{"id":"MGASA-2017-0018","title":"Updated irssi packages fix security vulnerabilities","description":"In irssi before 0.8.21, a NULL pointer dereference in the nickcmp\nfunction (CVE-2017-5193).\n\nIn irssi before 0.8.21, use after free when receiving invalid nick\nmessage (CVE-2017-5194).\n\nIn irssi before 0.8.21, out of bounds read in certain incomplete control\ncodes (CVE-2017-5195).\n\nIn irssi before 0.8.21, out of bounds read in certain incomplete\ncharacter sequences (CVE-2017-5196).\n\nIn irssi before 0.8.21, out of bounds read when printing certain values\n(CVE-2017-5356).\n","status":"published","published":"2017-01-14T21:05:17Z","modified":"2026-04-16T06:26:27.625019456Z","updated_at":"2026-11-02T15:49:40.103088Z"},{"id":"openSUSE-SU-2024:10865-1","title":"irssi-1.2.3-2.4 on GA media","description":"These are all security issues fixed in the irssi-1.2.3-2.4 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T04:27:28.449384Z","updated_at":"2026-11-02T16:58:34.894275Z"},{"id":"USN-3184-1","title":"irssi vulnerabilities","description":"It was discovered that the Irssi buf.pl script set incorrect permissions. A\nlocal attacker could use this issue to retrieve another user's window\ncontents. (CVE-2016-7553)\n\nJoseph Bisch discovered that Irssi incorrectly handled comparing nicks. A\nremote attacker could use this issue to cause Irssi to crash, resulting in\na denial of service, or possibly execute arbitrary code. (CVE-2017-5193)\n\nIt was discovered that Irssi incorrectly handled invalid nick messages. A\nremote attacker could use this issue to cause Irssi to crash, resulting in\na denial of service, or possibly execute arbitrary code. (CVE-2017-5194)\n\nJoseph Bisch discovered that Irssi incorrectly handled certain incomplete\ncontrol codes. A remote attacker could use this issue to cause Irssi to\ncrash, resulting in a denial of service, or possibly execute arbitrary\ncode. This issue only affected Ubuntu 16.04 LTS and Ubuntu 16.10.\n(CVE-2017-5195)\n\nHanno Böck and Joseph Bisch discovered that Irssi incorrectly handled\ncertain incomplete character sequences. A remote attacker could use this\nissue to cause Irssi to crash, resulting in a denial of service. This issue\nonly affected Ubuntu 16.04 LTS and Ubuntu 16.10. (CVE-2017-5196)\n\nHanno Böck discovered that Irssi incorrectly handled certain format\nstrings. A remote attacker could use this issue to cause Irssi to crash,\nresulting in a denial of service. (CVE-2017-5356)\n","status":"published","published":"2017-02-01T18:08:38Z","modified":"2026-04-22T09:31:51.901453Z","updated_at":"2026-11-02T16:58:10.303275Z"}]}}