Bugzilla – Bug 1029020
VUL-0: CVE-2017-7191: irssi: use after free in netjoin condition [CWE-416]
Last modified: 2017-03-20 17:11:29 UTC
Ref: http://seclists.org/oss-sec/2017/q1/581 ============================================ Dear CVE Assignment Team, please provide CVE for the following issue: use after free condition during netjoin processing [1] ====================================================== CWE Classification: CWE-416 Description ----------- Use after free while producing list of netjoins (CWE-416) This issue was found and reported to us by APic. Impact ------ This issue usually leads to segmentation faults. Targeted code execution should be difficult. Affected versions ----------------- Irssi up to and including 1.0.1 We believe Irssi 0.8.21 and prior are not affected since a different code path causes the netjoins to be flushed prior to reaching the use after free condition. Fixed in -------- Irssi 1.0.2 Recommended action ------------------ Upgrade to Irssi 1.0.2. Irssi 1.0.2 is a maintenance release without any new features. Patch ----- https://github.com/irssi/irssi/commit/77b2631c78461965bc9a7414aae206b5c514e1b3 References ---------- [1] https://irssi.org/security/irssi_sa_2017_03.txt ============================================ https://software.opensuse.org/package/irssi TW|42.{1,2}: 1.0.1
I opened https://build.opensuse.org/request/show/478808
incident running
fixed
openSUSE-SU-2017:0737-1: An update that contains security fixes can now be installed. Category: security (moderate) Bug References: 1029020 CVE References: Sources used: openSUSE Leap 42.2 (src): irssi-1.0.2-15.1 openSUSE Leap 42.1 (src): irssi-1.0.2-15.1
openSUSE-SU-2017:0739-1: An update that contains security fixes can now be installed. Category: security (moderate) Bug References: 1029020 CVE References: Sources used: SUSE Package Hub for SUSE Linux Enterprise 12 (src): irssi-1.0.2-21.1
http://seclists.org/oss-sec/2017/q1/653