Vulnerabilities

Irssi 1.3.x and 1.4.x before 1.4.4 has a use-after-free because of use of a stale special collector reference.

Irssi 1.2.x before 1.2.2 has a use-after-free if the IRC server sends a double CAP.

Irssi before 1.0.8, 1.1.x before 1.1.3, and 1.2.x before 1.2.1, when SASL is enabled, has a use after free when sending SASL login to the server.

Irssi 1.1.x before 1.1.2 has a use after free when hidden lines are expired from the scroll buffer.

An issue was discovered in Irssi before 1.0.7 and 1.1.x before 1.1.1.

An issue was discovered in Irssi before 1.0.7 and 1.1.x before 1.1.1.

An issue was discovered in Irssi before 1.0.7 and 1.1.x before 1.1.1.

An issue was discovered in Irssi before 1.0.7 and 1.1.x before 1.1.1.

An issue was discovered in Irssi before 1.0.7 and 1.1.x before 1.1.1.

In Irssi before 1.0.6, a calculation error in the completion code could cause a heap buffer overflow when completing certain strings.

When using an incomplete variable argument, Irssi before 1.0.6 may access data beyond the end of the string.

When the channel topic is set without specifying a sender, Irssi before 1.0.6 may dereference a NULL pointer.

When using incomplete escape codes, Irssi before 1.0.6 may access data beyond the end of the string.

In Irssi before 1.0.5, overlong nicks or targets may result in a NULL pointer dereference while splitting the message.

In certain cases, Irssi before 1.0.5 may fail to verify that a Safe channel ID is long enough, causing reads beyond the end of the string.

In Irssi before 1.0.5, certain incorrectly formatted DCC CTCP messages could cause a NULL pointer dereference.

Irssi before 1.0.5, when installing themes with unterminated colour formatting sequences, may access data beyond the end of the string.

Irssi before 1.0.5, while waiting for the channel synchronisation, may incorrectly fail to remove destroyed channels from the query list, resulting in use-after-free conditions when updating the state later on.

An issue was discovered in Irssi before 1.0.4.

An issue was discovered in Irssi before 1.0.4.

In Irssi before 1.0.3, when receiving certain incorrectly quoted DCC files, it tries to find the terminating quote one byte before the allocated memory.

In Irssi before 1.0.3, when receiving a DCC message without source nick/host, it attempts to dereference a NULL pointer.

The netjoin processing in Irssi 1.x before 1.0.2 allows attackers to cause a denial of service (use-after-free) and possibly execute arbitrary code via unspecified vectors.

Irssi before 0.8.21 allows remote attackers to cause a denial of service (out-of-bounds read and crash) via a string containing a formatting sequence (%[) without a closing bracket (]).

Irssi 0.8.18 before 0.8.21 allows remote attackers to cause a denial of service (out-of-bounds read and crash) via vectors involving strings that are not UTF8.