Security update for irssi SUSE Patch security@suse.de SUSE Security Team openSUSE-SU-2017:1824-1 Final 1 1 2017-07-07T23:03:39Z current 2017-07-07T23:03:39Z 2017-07-07T23:03:39Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for irssi This update for irssi to version fixes the following issues: - CVE-2017-10965: A malicious server could cause irssi to crash by providing an invalid timestamp - CVE-2017-10966: Undefined behavior may be triggered when irssi updates the internal nick list A number of minor upstream bug fixes are also included. The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). openSUSE-2017-797 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1047709 SUSE Bug 1047709 https://www.suse.com/security/cve/CVE-2017-10965/ SUSE CVE CVE-2017-10965 page https://www.suse.com/security/cve/CVE-2017-10966/ SUSE CVE CVE-2017-10966 page SUSE Package Hub 12 irssi-1.0.4-28.1 irssi-devel-1.0.4-28.1 irssi-1.0.4-28.1 as a component of SUSE Package Hub 12 irssi-devel-1.0.4-28.1 as a component of SUSE Package Hub 12 An issue was discovered in Irssi before 1.0.4. When receiving messages with invalid time stamps, Irssi would try to dereference a NULL pointer. CVE-2017-10965 SUSE Package Hub 12:irssi-1.0.4-28.1 SUSE Package Hub 12:irssi-devel-1.0.4-28.1 critical 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2017-10965.html CVE-2017-10965 https://bugzilla.suse.com/1047709 SUSE Bug 1047709 An issue was discovered in Irssi before 1.0.4. While updating the internal nick list, Irssi could incorrectly use the GHashTable interface and free the nick while updating it. This would then result in use-after-free conditions on each access of the hash table. CVE-2017-10966 SUSE Package Hub 12:irssi-1.0.4-28.1 SUSE Package Hub 12:irssi-devel-1.0.4-28.1 critical 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2017-10966.html CVE-2017-10966 https://bugzilla.suse.com/1047709 SUSE Bug 1047709