CVE-2017-9469

EUVD-2017-18401
In Irssi before 1.0.3, when receiving certain incorrectly quoted DCC files, it tries to find the terminating quote one byte before the allocated memory. Thus, remote attackers might be able to cause a crash.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
7.5 HIGH
NETWORK
LOW
NONE
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: 84%
Affected Products (NVD)
VendorProductVersion
irssiirssi
𝑥
≤ 1.0.2
debiandebian_linux
8.0
debiandebian_linux
9.0
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
irssi
bookworm
1.4.3-2
fixed
bullseye
1.2.3-1
fixed
sid
1.4.5-1
fixed
trixie
1.4.5-1
fixed
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
irssi
trusty
Fixed 0.8.15-5ubuntu3.2
released
xenial
Fixed 0.8.19-1ubuntu1.4
released
yakkety
Fixed 0.8.19-1ubuntu2.2
released
zesty
Fixed 0.8.20-2ubuntu2.1
released
Common Weakness Enumeration
References
http://openwall.com/lists/oss-security/2017/06/06/4
http://www.debian.org/security/2017/dsa-3885
http://www.securityfocus.com/bid/99043
http://www.securitytracker.com/id/1038621
https://irssi.org/security/irssi_sa_2017_06.txt
http://openwall.com/lists/oss-security/2017/06/06/4
http://www.debian.org/security/2017/dsa-3885
http://www.securityfocus.com/bid/99043
http://www.securitytracker.com/id/1038621
https://irssi.org/security/irssi_sa_2017_06.txt