CVE-2017-10966

Upstream information

CVE-2017-10966 at MITRE

Description

An issue was discovered in Irssi before 1.0.4. While updating the internal nick list, Irssi could incorrectly use the GHashTable interface and free the nick while updating it. This would then result in use-after-free conditions on each access of the hash table.

---

SUSE information

Overall state of this security issue: Does not affect SUSE products

This issue is currently rated as having moderate severity.

CVSS v2 Scores

	National Vulnerability Database
Base Score	7.5
Vector	AV:N/AC:L/Au:N/C:P/I:P/A:P
Access Vector	Network
Access Complexity	Low
Authentication	None
Confidentiality Impact	Partial
Integrity Impact	Partial
Availability Impact	Partial

CVSS v3 Scores

	National Vulnerability Database
Base Score	9.8
Vector	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Access Vector	Network
Access Complexity	Low
Privileges Required	None
User Interaction	None
Scope	Unchanged
Confidentiality Impact	High
Integrity Impact	High
Availability Impact	High
CVSSv3 Version	3

SUSE Bugzilla entry: 1047709 [RESOLVED / FIXED]

SUSE Security Advisories:

• openSUSE-SU-2017:1823-1, published Sat, 8 Jul 2017 06:10:09 +0200 (CEST)
• openSUSE-SU-2017:1824-1, published Sat, 8 Jul 2017 06:10:25 +0200 (CEST)

List of released packages

Product(s)	Fixed package version(s)	References
SUSE Package Hub 12	irssi >= 1.0.4-28.1 irssi-devel >= 1.0.4-28.1	Patchnames: openSUSE-2017-797
openSUSE Tumbleweed	irssi >= 1.2.3-2.4 irssi-devel >= 1.2.3-2.4	Patchnames: openSUSE Tumbleweed GA irssi-1.2.3-2.4