CVE-2018-7054: Use After Free
An issue was discovered in Irssi before 1.0.7 and 1.1.x before 1.1.1. There is a use-after-free when a server is disconnected during netsplits. NOTE: this issue exists because of an incomplete fix for CVE-2017-7191.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/irssito a version that resolves this vulnerability.Fixed in 1.2.3-1Fixed in 1.4.3-2Fixed in 1.4.5-1 - Upgrade
Upgrade
Irssito a version that resolves this vulnerability.Fixed in 1.0.7 - Upgrade
Upgrade
Irssito a version that resolves this vulnerability.Fixed in 1.1.1
Event History
Frequently Asked Questions
What is the severity of CVE-2018-7054?
CVE-2018-7054 has a severity rating of medium due to the potential for exploitation through a use-after-free condition.
How do I fix CVE-2018-7054?
To fix CVE-2018-7054, update Irssi to version 1.0.7 or higher, or to versions 1.1.1 and above.
What software is affected by CVE-2018-7054?
CVE-2018-7054 affects Irssi versions before 1.0.7 and 1.1.0, specifically those released in the 1.1.x series prior to 1.1.1.
What does CVE-2018-7054 impact in terms of functionality?
CVE-2018-7054 impacts the stability of the Irssi client by potentially allowing an attacker to cause a crash or execute arbitrary code.
Is there any known exploitation of CVE-2018-7054 in the wild?
As of now, there have been no reported cases of active exploitation of CVE-2018-7054 in the wild.