Critical severity · published Jul 7, 2017
CVE-2017-10966
An issue was discovered in Irssi before 1.0.4
9.8
CVSS
2.9%
EPSS
No
On KEV
Description
An issue was discovered in Irssi before 1.0.4. While updating the internal nick list, Irssi could incorrectly use the GHashTable interface and free the nick while updating it. This would then result in use-after-free conditions on each access of the hash table.
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)2.9% · higher than 87% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
IR
Irssi · Irssi
through 1.0.3 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2017-10966
CVE.org
https://www.cve.org/CVERecord?id=CVE-2017-10966
Issue Tracking
https://github.com/irssi/irssi/commit/5e26325317c72a04c1610ad952974e206384d291
Patch
https://irssi.org/security/irssi_sa_2017_07.txt
www.debian.org
https://www.debian.org/security/2017/dsa-4016
More from Irssi
9.8
CVE-2019-15717
Irssi 1.2.x before 1.2.2 has a use-after-free if the IRC server sends a double CAP
9.8
CVE-2019-5882
Irssi 1.1.x before 1.1.2 has a use after free when hidden lines are expired from the scroll buffer
9.8
CVE-2018-7054
An issue was discovered in Irssi before 1.0.7 and 1.1.x before 1.1.1
9.8
CVE-2018-7053
An issue was discovered in Irssi before 1.0.7 and 1.1.x before 1.1.1
9.8
CVE-2018-5208
In Irssi before 1.0.6, a calculation error in the completion code could cause a heap buffer overflow when completing certain strings