Null pointer dereference in Irssi - CVE-2017-9468

Vulnerability identifier: #VU6954

CSH Severity: Low

CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

CVE-ID: CVE-2017-9468

CWE-ID: CWE-476

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to cause DoS condition on the target system.

The weakness exists due to NULL pointer dereference. A remote attacker can return a specially crafted DCC message without a source nick or host value and cause the application to crash.

Successful exploitation of the vulnerability results in denial of service.

Irssi
Arch Linux
Debian Linux
Slackware Linux
Ubuntu
Fedora
irssi (Alpine package)
irssi

Update to version 1.0.3.

irssi (Alpine package) - update to 0.8.21-r1
irssi - addressed in versions 1.0.3-1.fc24, 1.0.3-1.fc25, 1.0.3-1.fc26

• https://irssi.org/security/irssi_sa_2017_06.txt

• Two vulnerabilities in Irssi
• Arch Linux update for irssi
• Ubuntu update for Irssi
• Debian update for irssi
• Slackware Linux update for irssi
• Null pointer dereference in irssi (Alpine package)
• Arch Linux update for irssi
• Fedora 26 update for irssi
• Fedora 25 update for irssi
• Fedora 24 update for irssi