{"id":"CVE-2017-9469","aliases":["ALPINE-CVE-2017-9469","DEBIAN-CVE-2017-9469","DLA-1088-1","DSA-3885-1","EUVD-2017-18401","GHSA-4fcw-x547-92cj","MGASA-2017-0185","UBUNTU-CVE-2017-9469","USN-3317-1","openSUSE-SU-2017:1505-1","openSUSE-SU-2017:1515-1","openSUSE-SU-2024:10865-1"],"status":"published","title":"In Irssi before 1.0.3, when receiving certain incorrectly quoted DCC files, it tries to find the...","description":"In Irssi before 1.0.3, when receiving certain incorrectly quoted DCC files, it tries to find the terminating quote one byte before the allocated memory. Thus, remote attackers might be able to cause a crash.","severity":{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.06084,"percentile":0.93459,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-119"],"published":"2017-06-06T00:00:00Z","modified":"2026-10-24T10:30:59Z","fixes":[{"ecosystem":"Alpine:v3.10","package":"irssi","fixed_in":["1.0.3-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.11","package":"irssi","fixed_in":["1.0.3-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.12","package":"irssi","fixed_in":["1.0.3-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.13","package":"irssi","fixed_in":["1.0.3-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.14","package":"irssi","fixed_in":["1.0.3-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.15","package":"irssi","fixed_in":["1.0.3-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.16","package":"irssi","fixed_in":["1.0.3-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.17","package":"irssi","fixed_in":["1.0.3-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.6","package":"irssi","fixed_in":["1.0.3-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.7","package":"irssi","fixed_in":["1.0.3-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.8","package":"irssi","fixed_in":["1.0.3-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.9","package":"irssi","fixed_in":["1.0.3-r0"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"irssi","fixed_in":["1.0.3-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"irssi","fixed_in":["1.0.3-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"irssi","fixed_in":["1.0.3-1"],"sources":["osv"]},{"ecosystem":"Ubuntu:14.04:LTS","package":"irssi","fixed_in":["0.8.15-5ubuntu3.2"],"sources":["osv"]},{"ecosystem":"Ubuntu:16.04:LTS","package":"irssi","fixed_in":["0.8.19-1ubuntu1.4"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.10","package":"irssi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.3-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.11","package":"irssi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.3-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.12","package":"irssi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.3-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.13","package":"irssi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.3-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.14","package":"irssi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.3-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.15","package":"irssi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.3-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.16","package":"irssi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.3-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.17","package":"irssi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.3-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.6","package":"irssi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.3-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.7","package":"irssi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.3-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.8","package":"irssi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.3-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.9","package":"irssi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.3-r0"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"irssi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.3-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"irssi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.3-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"irssi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.3-1"}]}]},{"source":"osv","ecosystem":"Debian:7","package":"irssi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.8.15-5+deb7u2"}]}],"versions":["0.8.15-5","0.8.15-5+deb7u1"],"bundled":2},{"source":"osv","ecosystem":"Debian:8","package":"irssi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.8.17-1+deb8u4"}]}],"versions":["0.8.17-1","0.8.17-1+deb8u1","0.8.17-1+deb8u1~bpo70+1","0.8.17-1+deb8u2","0.8.17-1+deb8u3"],"bundled":2},{"source":"osv","ecosystem":"Debian:9","package":"irssi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.2-1+deb9u1"}]}],"versions":["1.0.2-1"],"bundled":2},{"source":"osv","ecosystem":"Mageia:5","package":"irssi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.8.21-1.1.mga5"}]}],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"irssi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.8.15-5ubuntu3.2"}]}],"versions":["0.8.15-5ubuntu2","0.8.15-5ubuntu3","0.8.15-5ubuntu3.1"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"irssi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.8.19-1ubuntu1.4"}]}],"versions":["0.8.17-1ubuntu1","0.8.17-1ubuntu2","0.8.18-1ubuntu1","0.8.19-1ubuntu1","0.8.19-1ubuntu1.2","0.8.19-1ubuntu1.3"]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"irssi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.8.15-5ubuntu3.2"}]}],"versions":["0.8.15-5ubuntu2","0.8.15-5ubuntu3","0.8.15-5ubuntu3.1"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"irssi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.8.19-1ubuntu1.4"}]}],"versions":["0.8.17-1ubuntu1","0.8.17-1ubuntu2","0.8.18-1ubuntu1","0.8.19-1ubuntu1","0.8.19-1ubuntu1.2","0.8.19-1ubuntu1.3"],"bundled":2},{"source":"osv","ecosystem":"SUSE:Package Hub 12","package":"irssi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.3-25.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Package Hub 12","package":"irssi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.3-25.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"irssi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.3-2.4"}]}],"bundled":26}],"products":[{"vendor":"debian","product":"debian_linux"},{"vendor":"irssi","product":"irssi"}],"references":[{"url":"http://www.debian.org/security/2017/dsa-3885","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","Third Party Advisory","advisory"]},{"url":"http://openwall.com/lists/oss-security/2017/06/06/4","tags":["x_refsource_CONFIRM","x_transferred","Mailing List","Patch","Third Party Advisory","fix","report"]},{"url":"https://irssi.org/security/irssi_sa_2017_06.txt","tags":["x_refsource_CONFIRM","x_transferred","Patch","Vendor Advisory","fix","report"]},{"url":"http://www.securityfocus.com/bid/99043","tags":["vdb-entry","x_refsource_BID","x_transferred","Third Party Advisory","VDB Entry","advisory"]},{"url":"http://www.securitytracker.com/id/1038621","tags":["vdb-entry","x_refsource_SECTRACK","x_transferred","Third Party Advisory","VDB Entry","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-9469"},{"url":"https://github.com/advisories/GHSA-4fcw-x547-92cj"},{"url":"https://security.alpinelinux.org/vuln/CVE-2017-9469","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2017-9469","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2017-0185.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=21037","tags":["report"]},{"url":"https://www.ubuntu.com/usn/usn-3317-1/","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2017-9469","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-3317-1","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2017-9469","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-9468","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1043051","tags":["report"]},{"url":"https://bugzilla.suse.com/1043052","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2017-9468","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-9469","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-10965","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-10966","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-15227","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-15228","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-15721","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-15722","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-15723","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-5193","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-5194","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-5195","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-5196","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-5356","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-5205","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-5206","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-5207","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-5208","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-7050","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-7051","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-7052","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-7053","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-7054","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-13045","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-15717","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-5882","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2017-9469","description":"In Irssi before 1.0.3, when receiving certain incorrectly quoted DCC files, it tries to find the terminating quote one byte before the allocated memory. Thus, remote attackers might be able to cause a crash.","status":"published","published":"2017-06-07T01:00:00Z","modified":"2024-08-05T17:11:01.07Z","updated_at":"2026-11-02T14:33:13.606903Z"}],"euvd":[{"id":"EUVD-2017-18401","description":"In Irssi before 1.0.3, when receiving certain incorrectly quoted DCC files, it tries to find the terminating quote one byte before the allocated memory. Thus, remote attackers might be able to cause a crash.","status":"published","published":"2017-06-07T01:00:00Z","modified":"2024-08-05T17:11:01Z","updated_at":"2026-11-03T02:23:27.678389Z"}],"ghsa":[{"id":"GHSA-4fcw-x547-92cj","title":"In Irssi before 1.0.3, when receiving certain incorrectly quoted DCC files, it tries to find the...","description":"In Irssi before 1.0.3, when receiving certain incorrectly quoted DCC files, it tries to find the terminating quote one byte before the allocated memory. Thus, remote attackers might be able to cause a crash.","status":"published","published":"2022-05-14T01:20:24Z","modified":"2023-02-02T05:03:34Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-119"],"updated_at":"2026-11-02T14:51:39.940381Z"}],"nvd":[{"id":"CVE-2017-9469","description":"In Irssi before 1.0.3, when receiving certain incorrectly quoted DCC files, it tries to find the terminating quote one byte before the allocated memory. Thus, remote attackers might be able to cause a crash.","status":"published","published":"2017-06-07T01:29:01.11Z","modified":"2026-06-17T01:28:10.85Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-119"],"updated_at":"2026-11-02T14:03:50.782497Z"}],"osv":[{"id":"ALPINE-CVE-2017-9469","description":"In Irssi before 1.0.3, when receiving certain incorrectly quoted DCC files, it tries to find the terminating quote one byte before the allocated memory. Thus, remote attackers might be able to cause a crash.","status":"published","published":"2017-06-07T01:29:01.11Z","modified":"2026-06-15T18:25:25.253961445Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:27:47.187336Z"},{"id":"CVE-2017-9469","description":"In Irssi before 1.0.3, when receiving certain incorrectly quoted DCC files, it tries to find the terminating quote one byte before the allocated memory. Thus, remote attackers might be able to cause a crash.","status":"published","published":"2017-06-07T01:29:01.11Z","modified":"2026-10-24T10:30:59.045750733Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:07.192756Z"},{"id":"DEBIAN-CVE-2017-9469","description":"In Irssi before 1.0.3, when receiving certain incorrectly quoted DCC files, it tries to find the terminating quote one byte before the allocated memory. Thus, remote attackers might be able to cause a crash.","status":"published","published":"2017-06-07T01:29:01.11Z","modified":"2026-09-01T20:03:51.745827863Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:29.698576Z"},{"id":"UBUNTU-CVE-2017-9469","description":"In Irssi before 1.0.3, when receiving certain incorrectly quoted DCC files, it tries to find the terminating quote one byte before the allocated memory. Thus, remote attackers might be able to cause a crash.","status":"published","published":"2017-06-06T00:00:00Z","modified":"2026-04-22T11:36:55.979493Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:54:16.154988Z"},{"id":"DLA-1088-1","title":"irssi - security update","status":"published","published":"2017-09-04T00:00:00Z","modified":"2026-03-09T01:01:28.52892Z","updated_at":"2026-11-02T15:46:09.336894Z"},{"id":"DSA-3885-1","title":"irssi - security update","status":"published","published":"2017-06-18T00:00:00Z","modified":"2026-03-09T01:19:19.493171Z","updated_at":"2026-11-02T15:46:16.523846Z"},{"id":"MGASA-2017-0185","title":"Updated irssi packages fix security vulnerabilities","description":"It was discovered that Irssi incorrectly handled certain DCC messages.\nA malicious IRC server could use this issue to cause Irssi to crash,\nresulting in a denial of service (CVE-2017-9468).\n\nJoseph Bisch discovered that Irssi incorrectly handled receiving\nincorrectly quoted DCC files. A remote attacker could possibly use this\nissue to cause Irssi to crash, resulting in a denial of service\n(CVE-2017-9469).\n","status":"published","published":"2017-06-26T21:37:03Z","modified":"2026-04-16T06:25:57.57994329Z","updated_at":"2026-11-02T15:49:40.103088Z"},{"id":"openSUSE-SU-2017:1505-1","title":"Security update for irssi","description":"This update to irssi 1.0.3 fixes the following vulnerabilities:\n\n- CVE-2017-9469: irssi: dcc crash with incorrect quoting (bsc#1043052)\n- CVE-2017-9468: irssi: dcc message crash without nick/host (bsc#1043051)","status":"published","published":"2017-06-08T11:11:34Z","modified":"2026-02-04T02:40:00.025909Z","updated_at":"2026-11-02T16:58:30.39372Z"},{"id":"openSUSE-SU-2017:1515-1","title":"Security update for irssi","description":"This update to irssi 1.0.3 fixes the following vulnerabilities:\n\n- CVE-2017-9469: irssi: dcc crash with incorrect quoting (bsc#1043052)\n- CVE-2017-9468: irssi: dcc message crash without nick/host (bsc#1043051)","status":"published","published":"2017-06-08T11:11:34Z","modified":"2026-02-04T03:16:30.848095Z","updated_at":"2026-11-02T16:58:30.39372Z"},{"id":"openSUSE-SU-2024:10865-1","title":"irssi-1.2.3-2.4 on GA media","description":"These are all security issues fixed in the irssi-1.2.3-2.4 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T04:27:28.449384Z","updated_at":"2026-11-02T16:58:34.894275Z"},{"id":"USN-3317-1","title":"irssi vulnerabilities","description":"It was discovered that Irssi incorrectly handled certain DCC messages. A\nmalicious IRC server could use this issue to cause Irssi to crash,\nresulting in a denial of service. (CVE-2017-9468)\n\nJoseph Bisch discovered that Irssi incorrectly handled receiving\nincorrectly quoted DCC files. A remote attacker could possibly use this\nissue to cause Irssi to crash, resulting in a denial of service.\n(CVE-2017-9469)\n","status":"published","published":"2017-06-12T12:30:47Z","modified":"2026-04-22T09:36:13.929113Z","updated_at":"2026-11-02T16:58:13.496563Z"}]}}