NULL pointer dereference in Irssi - CVE-2018-7050

Vulnerability identifier: #VU10606

CSH Severity: Low

CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2018-7050

CWE-ID: CWE-476

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to cause DoS condition on the target system.

The weakness exists due to a NULL pointer dereference when an "empty" nick has been observed. A remote attacker can use a broken ircd or control over the ircde and cause the service to crash.

Irssi
Arch Linux
Debian Linux
Slackware Linux
Fedora
irssi (Alpine package)
irssi

Update to version 1.0.7, 1.1.1.

irssi (Alpine package) - update to 1.0.6-r0
irssi - addressed in versions 1.0.7-1.fc26, 1.0.7-1.fc27

• https://irssi.org/security/irssi_sa_2018_02.txt

• Slackware Linux update for irssi
• Arch Linux update for irssi
• Debian update for irssi
• Slackware Linux update for irssi
• NULL pointer dereference in irssi (Alpine package)
• Fedora 27 update for irssi
• Fedora 26 update for irssi