Bug 1532573 (CVE-2018-5205)

Summary:	CVE-2018-5205 irssi: Out-of-bounds read when using incomplete escape codes
Product:	[Other] Security Response	Reporter:	Adam Mariš <amaris>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED WONTFIX	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	huzaifas, jskarvad
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	irssi 1.0.6	Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2019-06-08 03:36:36 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1532625, 1532626
Bug Blocks:

Description Adam Mariš 2018-01-09 11:28:05 UTC

When using incomplete escape codes, Irssi may access data beyond the end of the string.

The exploitation of the issue requires user to install malicious or broken files or enter affected commands.

Comment 1 Adam Mariš 2018-01-09 11:28:32 UTC

External References:

https://irssi.org/security/irssi_sa_2018_01.txt

Comment 2 Adam Mariš 2018-01-09 13:17:49 UTC

Created irssi tracking bugs for this issue:

Affects: fedora-all [bug 1532625]