NULL pointer dereference in Irssi - CVE-2017-10965

Vulnerability identifier: #VU7400

CSH Severity: Low

CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2017-10965

CWE-ID: CWE-476

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference error when parsing messages with invalid time stamps in Irssi. A remote attacker can send a specially crafted message and crash the affected server.

Irssi
Arch Linux
Slackware Linux
Ubuntu
Fedora
irssi (Alpine package)
irssi

Update to version 1.0.4.

irssi (Alpine package) - update to 0.8.21-r2
irssi - addressed in versions 1.0.4-1.fc25, 1.0.4-1.fc26

• https://irssi.org/security/irssi_sa_2017_07.txt
• https://github.com/irssi/irssi/commit/5e26325317c72a04c1610ad952974e206384d291

• Multiple vulnerabilities in Irssi
• Slackware Linux update for irssi
• Arch Linux update for irssi
• Ubuntu update for Irssi
• NULL pointer dereference in irssi (Alpine package)
• Fedora 26 update for irssi
• Fedora 25 update for irssi