Use-after-free error in Irssi - CVE-2018-7054

Vulnerability identifier: #VU10609

CSH Severity: High

CVSS v4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2018-7054

CWE-ID: CWE-416

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The weakness is due to a use-after-free when server is disconnected during netsplits. A remote attacker can trigger memory corruption and execute arbitrary code.

Successful exploitation of the vulnerability may result in system compromise.

Irssi
Arch Linux
Debian Linux
Slackware Linux
Fedora
irssi (Alpine package)
irssi

Update to version 1.0.7, 1.1.1.

irssi (Alpine package) - update to 1.0.6-r0
irssi - addressed in versions 1.0.7-1.fc26, 1.0.7-1.fc27

• https://irssi.org/security/irssi_sa_2018_02.txt

• Slackware Linux update for irssi
• Arch Linux update for irssi
• Debian update for irssi
• Slackware Linux update for irssi
• Use-after-free error in irssi (Alpine package)
• Fedora 27 update for irssi
• Fedora 26 update for irssi