Description
-----------

Two vulnerabilities have been located in Irssi.

(a) When receiving a DCC message without source nick/host, Irssi would
    attempt to dereference a NULL pointer. Found by Joseph
    Bisch. (CWE-690)

CVE-2017-9468 [http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-9468] was assigned to this bug

(b) When receiving certain incorrectly quoted DCC files, Irssi would
    try to find the terminating quote one byte before the allocated
    memory. Found by Joseph Bisch. (CWE-129, CWE-127)

CVE-2017-9469 [http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-9469] was assigned to this bug

CC: (none) => makowski.mageia

1.0.3 pushed to Cauldron.

Thanks Jani!

Status: NEW => RESOLVED
Summary: irssi new security issues fixed upstream in 1.0.3 => irssi new security issues fixed upstream in 1.0.3 (CVE-2017-9468 and CVE-2017-9469)
Resolution: (none) => FIXED

Reference for the CVEs:
http://openwall.com/lists/oss-security/2017/06/07/2

Apparently these affect 0.8.x as well.

Ubuntu has issued an advisory for this today (June 12):
https://www.ubuntu.com/usn/usn-3317-1/

Version: Cauldron => 5
Resolution: FIXED => (none)
Status: RESOLVED => REOPENED

Pushed 0.8.21-1.1.mga5 to core/updates_testing for mga5.

CC: (none) => jani.valimaa
Assignee: jani.valimaa => qa-bugs

Thanks Jani!

Advisory:
========================

Updated irssi packages fix security vulnerabilities:

It was discovered that Irssi incorrectly handled certain DCC messages. A
malicious IRC server could use this issue to cause Irssi to crash, resulting in
a denial of service (CVE-2017-9468).

Joseph Bisch discovered that Irssi incorrectly handled receiving incorrectly
quoted DCC files. A remote attacker could possibly use this issue to cause
Irssi to crash, resulting in a denial of service (CVE-2017-9469).

References:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-9468
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-9469
https://www.ubuntu.com/usn/usn-3317-1/
========================

Updated packages in core/updates_testing:
========================
irssi-0.8.21-1.1.mga5
irssi-devel-0.8.21-1.1.mga5
irssi-perl-0.8.21-1.1.mga5

from irssi-0.8.21-1.1.mga5.src.rpm

Already use irssi so went for the update on x86_64.
All three packages installed cleanly.  
Logged in to freenode and joined #mageia-qa.  Leaving it running for the meeting.
Shall OK it afterwards.

CC: (none) => tarazed25

OK for 64-bits.  Sure it had nothing to do with the surfeit of underscores ;-).

The following 2 packages are going to be installed:

- irssi-0.8.21-1.mga5.i586
- irssi-perl-0.8.21-1.mga5.i586

2.5MB of additional disk space will be used.

706KB of packages will be retrieved.

Is it ok to continue?



Able to open irssi and connect to irc.freenode.net and also #magiea channel

$ irssi
/connect irc.freenode.net
/join #mageia


Working as designed.  Noticed activity and benmc said "Hi"

Whiteboard: MGA5-64-OK => MGA5-64-OK mga5-32-ok
CC: (none) => brtians1

Validating & advisoried.

Whiteboard: MGA5-64-OK mga5-32-ok => MGA5-64-OK mga5-32-ok advisory
Keywords: (none) => validated_update
CC: (none) => lewyssmith, sysadmin-bugs

An update for this issue has been pushed to the Mageia Updates repository.

http://advisories.mageia.org/MGASA-2017-0185.html

Resolution: (none) => FIXED
Status: REOPENED => RESOLVED