Irssi vulnerabilities

By year

Bars are flaws published each year; the red part is the share attackers have used.

Latest high and critical flaws

• CVE-2020-29602 The official irssi docker images before 1.1-alpine (Alpine specific) contain a blank password for a root user.Critical 9.8 · Dec 8, 2020
• CVE-2019-15717 Irssi 1.2.x before 1.2.2 has a use-after-free if the IRC server sends a double CAP.Critical 9.8 · Aug 29, 2019
• CVE-2019-13045 Irssi before 1.0.8, 1.1.x before 1.1.3, and 1.2.x before 1.2.1, when SASL is enabled, has a use after free when sending SASL login to the server.High 8.1 · Jun 29, 2019
• CVE-2019-5882 Irssi 1.1.x before 1.1.2 has a use after free when hidden lines are expired from the scroll buffer.Critical 9.8 · Jan 9, 2019
• CVE-2018-7054 An issue was discovered in Irssi before 1.0.7 and 1.1.x before 1.1.1.Critical 9.8 · Feb 15, 2018
• CVE-2018-7053 An issue was discovered in Irssi before 1.0.7 and 1.1.x before 1.1.1.Critical 9.8 · Feb 15, 2018
• CVE-2018-7052 An issue was discovered in Irssi before 1.0.7 and 1.1.x before 1.1.1.High 7.5 · Feb 15, 2018
• CVE-2018-7051 An issue was discovered in Irssi before 1.0.7 and 1.1.x before 1.1.1.High 7.5 · Feb 15, 2018
• CVE-2018-7050 An issue was discovered in Irssi before 1.0.7 and 1.1.x before 1.1.1.High 7.5 · Feb 15, 2018
• CVE-2018-5208 In Irssi before 1.0.6, a calculation error in the completion code could cause a heap buffer overflow when completing certain strings.Critical 9.8 · Jan 6, 2018
• CVE-2018-5207 When using an incomplete variable argument, Irssi before 1.0.6 may access data beyond the end of the string.High 7.5 · Jan 6, 2018
• CVE-2018-5206 When the channel topic is set without specifying a sender, Irssi before 1.0.6 may dereference a NULL pointer.Critical 9.8 · Jan 6, 2018
• CVE-2018-5205 When using incomplete escape codes, Irssi before 1.0.6 may access data beyond the end of the string.High 7.5 · Jan 6, 2018
• CVE-2017-15723 In Irssi before 1.0.5, overlong nicks or targets may result in a NULL pointer dereference while splitting the message.High 7.5 · Oct 22, 2017
• CVE-2017-15721 In Irssi before 1.0.5, certain incorrectly formatted DCC CTCP messages could cause a NULL pointer dereference.High 7.5 · Oct 22, 2017
• CVE-2017-15228 Irssi before 1.0.5, when installing themes with unterminated colour formatting sequences, may access data beyond the end of the string.High 7.5 · Oct 22, 2017
• CVE-2017-15227 Irssi before 1.0.5, while waiting for the channel synchronisation, may incorrectly fail to remove destroyed channels from the query list, resulting in use-afterHigh 7.5 · Oct 22, 2017
• CVE-2017-10966 An issue was discovered in Irssi before 1.0.4.Critical 9.8 · Jul 7, 2017
• CVE-2017-10965 An issue was discovered in Irssi before 1.0.4.Critical 9.8 · Jul 7, 2017
• CVE-2017-9469 In Irssi before 1.0.3, when receiving certain incorrectly quoted DCC files, it tries to find the terminating quote one byte before the allocated memory.High 7.5 · Jun 6, 2017
• CVE-2017-9468 In Irssi before 1.0.3, when receiving a DCC message without source nick/host, it attempts to dereference a NULL pointer.High 7.5 · Jun 6, 2017
• CVE-2017-7191 The netjoin processing in Irssi 1.x before 1.0.2 allows attackers to cause a denial of service (use-after-free) and possibly execute arbitrary code via unspecifCritical 9.8 · Mar 27, 2017
• CVE-2017-5356 Irssi before 0.8.21 allows remote attackers to cause a denial of service (out-of-bounds read and crash) via a string containing a formatting sequence (%[) withoHigh 7.5 · Mar 3, 2017
• CVE-2017-5196 Irssi 0.8.18 before 0.8.21 allows remote attackers to cause a denial of service (out-of-bounds read and crash) via vectors involving strings that are not UTF8.High 7.5 · Mar 3, 2017
• CVE-2017-5195 Irssi 0.8.17 before 0.8.21 allows remote attackers to cause a denial of service (out-of-bounds read and crash) via a crafted ANSI x8 color code.High 7.5 · Mar 3, 2017