ArchLinux: 201706-11: irssi: denial of service
Summary
- CVE-2017-9468 (denial of service)
In Irssi before 1.0.3, when receiving a DCC message without source
nick/host, it attempts to dereference a NULL pointer. Thus, remote IRC
servers can cause a crash.
- CVE-2017-9469 (denial of service)
In Irssi before 1.0.3, when receiving certain incorrectly quoted DCC
files, it tries to find the terminating quote one byte before the
allocated memory. Thus, remote attackers might be able to cause a
crash.
Resolution
Upgrade to 1.0.3-1.
# pacman -Syu "irssi>=1.0.3-1"
The problems have been fixed upstream in version 1.0.3.
References
https://github.com/irssi/irssi/commit/fb08fc7f1aa6b2e616413d003bf021612301ad55 http://openwall.com/lists/oss-security/2017/06/06/4 https://irssi.org/security/irssi_sa_2017_06.txt https://security.archlinux.org/CVE-2017-9468 https://security.archlinux.org/CVE-2017-9469
Workaround
None.