Skip to main content

Irssi CVE-2019-5882

CRITICAL
Use After Free (CWE-416)
2019-01-09 cve@mitre.org
Denial Of Service Use After Free Memory Corruption Irssi Ubuntu Linux
9.8
CVSS 3.0 · NVD
Share

Severity by source

NVD PRIMARY
9.8 CRITICAL
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

1
CVE Published
Jan 09, 2019 - 23:29 nvd
CRITICAL 9.8

DescriptionNVD

Irssi 1.1.x before 1.1.2 has a use after free when hidden lines are expired from the scroll buffer.

AnalysisAI

Irssi 1.1.x before 1.1.2 has a use after free when hidden lines are expired from the scroll buffer. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity.

Technical ContextAI

This vulnerability is classified as Use After Free (CWE-416), which allows attackers to access freed memory to execute arbitrary code or crash the application. Irssi 1.1.x before 1.1.2 has a use after free when hidden lines are expired from the scroll buffer. Affected products include: Irssi, Canonical Ubuntu Linux. Version information: before 1.1.2.

RemediationAI

A vendor patch is available. Apply the latest security update as soon as possible. Use smart pointers or garbage-collected languages. Set pointers to NULL after freeing. Enable memory sanitizers.

More in Irssi

View all
CVE-2017-5356 HIGH POC
7.5 Mar 03

Irssi before 0.8.21 allows remote attackers to cause a denial of service (out-of-bounds read and crash) via a string con
CVE-2016-7044 HIGH POC
7.5 Sep 27

The unformat_24bit_color function in the format parsing code in Irssi before 0.8.20, when compiled with true-color enabl
CVE-2016-7045 HIGH POC
7.5 Sep 27

The format_send_to_gui function in the format parsing code in Irssi before 0.8.20 allows remote attackers to cause a den
CVE-2017-7191 CRITICAL
9.8 Mar 27

The netjoin processing in Irssi 1.x before 1.0.2 allows attackers to cause a denial of service (use-after-free) and poss
CVE-2017-10965 CRITICAL
9.8 Jul 07

An issue was discovered in Irssi before 1.0.4. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploi
CVE-2017-10966 CRITICAL
9.8 Jul 07

An issue was discovered in Irssi before 1.0.4. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploi
CVE-2019-15717 CRITICAL
9.8 Aug 29

Irssi 1.2.x before 1.2.2 has a use-after-free if the IRC server sends a double CAP. Rated critical severity (CVSS 9.8),

CVE-2018-7054 CRITICAL
9.8 Feb 15

An issue was discovered in Irssi before 1.0.7 and 1.1.x before 1.1.1. Rated critical severity (CVSS 9.8), this vulnerabi
CVE-2018-7053 CRITICAL
9.8 Feb 15

An issue was discovered in Irssi before 1.0.7 and 1.1.x before 1.1.1. Rated critical severity (CVSS 9.8), this vulnerabi
CVE-2018-5208 CRITICAL
9.8 Jan 06

In Irssi before 1.0.6, a calculation error in the completion code could cause a heap buffer overflow when completing cer
CVE-2018-5206 CRITICAL
9.8 Jan 06

When the channel topic is set without specifying a sender, Irssi before 1.0.6 may dereference a NULL pointer. Rated crit
CVE-2019-13045 HIGH
8.1 Jun 29

Irssi before 1.0.8, 1.1.x before 1.1.3, and 1.2.x before 1.2.1, when SASL is enabled, has a use after free when sending

Same weakness CWE-416 – Use After Free

View all
CVE-2019-0708 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2014-0322 HIGH POC
8.8
CVE-2012-4792 HIGH POC
8.8
CVE-2009-4324 HIGH POC
7.8
CVE-2015-0313 CRITICAL POC
9.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2013-2551 HIGH POC
8.8

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2011-0609 HIGH POC
7.8

Share

CVE-2019-5882 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy