Buffer over-read in Irssi - CVE-2018-5208
Published: April 3, 2018
Vulnerability identifier: #VU11475
CSH Severity: Low
CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
CVE-ID: CVE-2018-5208
CWE-ID: CWE-126
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to cause DoS condition on the target system.
The weakness exists due to a calculation error in the completion code that triggers heap buffer overflow when completing certain strings. A remote attacker can cause the service to crash.
The weakness exists due to a calculation error in the completion code that triggers heap buffer overflow when completing certain strings. A remote attacker can cause the service to crash.
Affected software
Irssi
Arch Linux
Debian Linux
Slackware Linux
Ubuntu
Fedora
irssi (Alpine package)
irssi
Arch Linux
Debian Linux
Slackware Linux
Ubuntu
Fedora
irssi (Alpine package)
irssi
How to mitigate CVE-2018-5208
Update to version 1.0.6.
irssi (Alpine package) - update to 1.0.6-r0
irssi - addressed in versions 1.0.6-1.fc26, 1.0.6-1.fc27
irssi - addressed in versions 1.0.6-1.fc26, 1.0.6-1.fc27