Ubuntu 16.10: USN-3184-1 Critical: Irssi Denial Of Service

ubuntu

February 1, 2017

Several security issues were fixed in Irssi.

Summary

Several security issues were fixed in Irssi.

Software Description:

- irssi: terminal based IRC client

Details:

It was discovered that the Irssi buf.pl script set incorrect permissions. A

local attacker could use this issue to retrieve another user's window

contents. (CVE-2016-7553)

Joseph Bisch discovered that Irssi incorrectly handled comparing nicks. A

remote attacker could use this issue to cause Irssi to crash, resulting in

a denial of service, or possibly execute arbitrary code. (CVE-2017-5193)

It was discovered that Irssi incorrectly handled invalid nick messages. A

remote attacker could use this issue to cause Irssi to crash, resulting in

a denial of service, or possibly execute arbitrary code. (CVE-2017-5194)

Joseph Bisch discovered that Irssi incorrectly handled certain incomplete

control codes. A remote attacker could use this issue to cause Irssi to

crash, resulting in a denial of service, or possibly execute arbitrary

code. This issue only a...

Read the Full Advisory

Topics Covered

security advisory denial of service software update Ubuntu Irssi

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 16.10:
  irssi                           0.8.19-1ubuntu2.1

Ubuntu 16.04 LTS:
  irssi                           0.8.19-1ubuntu1.3

Ubuntu 14.04 LTS:
  irssi                           0.8.15-5ubuntu3.1

Ubuntu 12.04 LTS:
  irssi                           0.8.15-4ubuntu3.1

After a standard system update you need to restart Irssi to make all the
necessary changes.