PT-2019-3224 · Irssi+2 · Irssi+2

Publicado 2019-08-29 · Atualizado 2024-06-15 · CVE-2019-15717

Positive Technologies (AI Summary)

CVSS v2.0

10

Crítica

Vetor base

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Irssi versions 1.2.x through 1.2.1 Irssi version 1.2.2 is not affected, so the range is simplified to versions before 1.2.2.

Description The issue is related to a use-after-free error in the Irssi IRC client, which can be exploited by a remote attacker to execute arbitrary code or cause a denial of service. This occurs when the IRC server sends a double CAP.

Recommendations For Irssi versions 1.2.x through 1.2.1, update to version 1.2.2 or later to resolve the issue. As a temporary workaround, consider restricting access to the IRC server or disabling the CAP functionality until a patch is available.

Correção

Use After Free

Enumeração de Fraquezas

CWE-416

Identificadores relacionados

ALT-PU-2020-3468

ALT-PU-2020-3488

ALT-PU-2024-3802

BDU:2019-03213

CVE-2019-15717

MGASA-2019-0255

OPENSUSE-SU-2024:10865-1

Produtos afetados

Alt Linux

Irssi

Ubuntu

Referências · 72

• https://suse.com/security/cve/CVE-2017-5194 · Nota
• https://bdu.fstec.ru/vul/2019-02520 · Nota de Segurança
• https://errata.altlinux.org/ALT-PU-2024-3802 · Aviso do Fabricante
• https://security.alpinelinux.org/vuln/CVE-2019-15717 · Nota
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-10966 · Nota de Segurança
• https://suse.com/security/cve/CVE-2017-10965 · Nota
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-15721 · Nota de Segurança
• https://suse.com/security/cve/CVE-2018-5205 · Nota
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-15717 · Nota de Segurança
• https://irssi.org/security/irssi_sa_2019_08.txt · Aviso do Fabricante
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-15723 · Nota de Segurança
• https://suse.com/security/cve/CVE-2018-7054 · Nota
• https://ubuntu.com/security/notices/USN-4119-1 · Aviso do Fabricante
• https://suse.com/security/cve/CVE-2019-13045 · Nota
• https://security-tracker.debian.org/tracker/CVE-2019-15717 · Aviso do Fabricante