[Buildroot] [PATCH] irssi: security bump to version 1.0.6
Peter Korsgaard
peter at korsgaard.com
Mon Jan 8 21:54:06 UTC 2018
>>>>> "Peter" == Peter Korsgaard <peter at korsgaard.com> writes:
> From the advisory (https://irssi.org/security/irssi_sa_2018_01.txt):
> Multiple vulnerabilities have been located in Irssi.
> (a) When the channel topic is set without specifying a sender, Irssi
> may dereference NULL pointer. Found by Joseph Bisch. (CWE-476)
> CVE-2018-5206 was assigned to this issue.
> (b) When using incomplete escape codes, Irssi may access data beyond
> the end of the string. (CWE-126) Found by Joseph Bisch.
> CVE-2018-5205 was assigned to this issue.
> (c) A calculation error in the completion code could cause a heap
> buffer overflow when completing certain strings. (CWE-126) Found
> by Joseph Bisch.
> CVE-2018-5208 was assigned to this issue.
> (d) When using an incomplete variable argument, Irssi may access data
> beyond the end of the string. (CWE-126) Found by Joseph Bisch.
> CVE-2018-5207 was assigned to this issue.
> Signed-off-by: Peter Korsgaard <peter at korsgaard.com>
Committed to 2017.11.x, thanks.
--
Bye, Peter Korsgaard
More information about the buildroot
mailing list