Use-after-free in Irssi - CVE-2019-15717

Vulnerability details

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a use-after-free error when processing responses from IRC server with a double CAP. A remote attacker can trick the victim to connect to a malicious IRC server, trigger use-after-free error and execute arbitrary code on the target system..

Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.

Affected software

How to mitigate CVE-2019-15717

External References

• http://www.openwall.com/lists/oss-security/2019/08/29/3
• http://www.openwall.com/lists/oss-security/2019/08/29/5
• https://irssi.org/security/irssi_sa_2019_08.txt

Related Security Bulletins

• Arch Linux update for irssi
• Remote code execution in Irssi
• Ubuntu update for Irssi
• Use-after-free in irssi (Alpine package)
• Fedora 31 update for irssi