summaryrefslogtreecommitdiff
path: root/_data/security.yml
diff options
context:
space:
mode:
Diffstat (limited to '_data/security.yml')
-rw-r--r--_data/security.yml132
1 files changed, 132 insertions, 0 deletions
diff --git a/_data/security.yml b/_data/security.yml
index 72b9974..f229a7c 100644
--- a/_data/security.yml
+++ b/_data/security.yml
@@ -1,5 +1,112 @@
---
-
+ name: Historic
+ bugs:
+ -
+ cve: CVE-2002-0983
+ exploitable_by: client
+ affected_versions:
+ from: '*'
+ to: 0.8.4
+ fixed_version: 0.8.6
+ git_commit: b9b0917897bd3b78d105c3229deb390daa204cdd
+ credit: ripe@7a69ezine.org
+ description: |
+ Denial of service (crash) via an IRC channel that has a long topic followed by a certain string, possibly triggering a buffer overflow.
+ -
+ cve: CVE-2002-1840
+ exploitable_by: remote
+ important: True
+ affected_versions:
+ from: 0.8.4
+ to: 0.8.4
+ affected_note_bottom: 'downloaded after 2002-03-14'
+ description: |
+ The download server was compromised and the download was backdoored, which allows remote attackers to access the system. Always check the GPG signature!
+-
+ name: 0.8.9 issues
+ release_date: 2003-12-11
+ bugs:
+ -
+ cve: CVE-2003-1020
+ exploitable_by: client
+ affected_versions:
+ from: '*'
+ to: 0.8.8
+ fixed_version: 0.8.9
+ git_commit: ae7f177fb0ac0732239d3ff1b8dd208a31a7354d
+ credit: Rico Gloeckner
+ description: |
+ The format_send_to_gui function allows remote IRC users to cause a denial of service (crash).
+-
+ name: 0.8.10 issues
+ release_date: 2006-03-01
+ bugs:
+ -
+ cve: CVE-2006-0458
+ exploitable_by: client
+ affected_versions:
+ from: 0.8.9+
+ to: 0.8.9+
+ fixed_version: 0.8.10
+ git_commit: 6d42a00287ff144c5c597b5da158961e0c22847d
+ description: |
+ The DCC ACCEPT command handler allows remote attackers to cause a denial of service (application crash) via certain crafted arguments in a DCC command.
+-
+ name: 0.8.11 issues
+ release_date: 2007-08-12
+ bugs:
+ -
+ cve: CVE-2007-4396
+ exploitable_by: local (remote)
+ affected_versions:
+ from: '*'
+ to: 0.8.10
+ fixed_version: 0.8.11
+ git_commit: f0fb4c19d45e25fddee76e7c442b1e900666cd0c
+ credit: 'Wouter Coekaerts'
+ description: |
+ Multiple CRLF injection vulnerabilities in several scripts for Irssi allow user-assisted remote attackers to execute arbitrary IRC commands via CRLF sequences.
+-
+ name: 0.8.14 issues
+ release_date: 2009-05-28
+ bugs:
+ -
+ cve: CVE-2009-1959
+ exploitable_by: client
+ affected_versions:
+ from: '*'
+ to: 0.8.13
+ fixed_version: 0.8.14
+ git_commit: 1f9c560a7408bf5550e030b5ac0c07dad5435eb1
+ credit: nemo@felinemenace.org
+ description: |
+ Off-by-one error in the event_wallops function allows remote IRC servers to cause a denial of service (crash) via an empty command, which triggers a one-byte buffer under-read and a one-byte buffer underflow.
+-
+ name: 0.8.15 issues
+ release_date: 2010-04-03
+ bugs:
+ -
+ cve: CVE-2010-1155
+ affected_versions:
+ from: '*'
+ to: 0.8.14
+ fixed_version: 0.8.15
+ git_commit: bb4ce4562bd04eeb24a5953dd8da5c843c04e328
+ description: |
+ Irssi does not verify that the server hostname matches a domain name in the SSL certificate.
+ -
+ cve: CVE-2010-1156
+ exploitable_by: client
+ affected_versions:
+ from: '*'
+ to: 0.8.14
+ fixed_version: 0.8.15
+ git_commit: 1aa10ece887afd5d64eca1211aeced6cab310680
+ credit: 'Aurelien Delaitre (SATE 2009)'
+ description: |
+ core/nicklist.c in Irssi allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via vectors related to an attempted fuzzy nick match at the instant that a victim leaves a channel.
+-
name: IRSSI-SA-2016
release_date: 2016-09-14
git_commit: 295a4b77f07f14602eeaa371f00ddbf09910c82b
@@ -92,6 +199,31 @@
credit: 'Hanno Böck and independently by Joseph Bisch'
description: 'Out of bounds read in certain incomplete character sequences'
-
+ name: Bulletin
+ release_date: 2017-02-05
+ link: http://www.openwall.com/lists/oss-security/2017/02/05/8
+ bugs:
+ -
+ name: '(a)'
+ exploitable_by: server
+ affected_versions:
+ from: 1.0.0
+ to: 1.0.0
+ fixed_version: 1.0.1
+ credit: 'Joseph Bisch'
+ description: 'Memory leak in some cases where a hostile server would send certain incomplete SASL replies'
+ git_commit: 19c51789967a2f63da033e60f6ef08848b9cd144
+ -
+ name: '(b)'
+ exploitable_by: '-'
+ affected_versions:
+ from: '*'
+ to: 1.0.0
+ fixed_version: 1.0.1
+ credit: 'Hanno Böck'
+ description: 'Missing NULL sentinel when initialising the Perl interpreter'
+ git_commit: 1f42d2aa950e4d70bf4c4aebae3a7040bd710cf3
+-
name: IRSSI-SA-2017-03
release_date: 2017-03-10
git_commit: 77b2631c78461965bc9a7414aae206b5c514e1b3