irssi

Use after free when receiving duplicate CAP found.

Irssi 1.0.x before 1.0.8, 1.1.x before 1.1.3, and 1.2.x before 1.2.1, when SASL is enabled, has a use after free when sending SASL login to the server.

A use-after-free vulnerability has been found in irssi before 1.1.2, when hidden lines were expired from the scroll buffer.

An issue was discovered in Irssi before 1.0.7 and 1.1.x before 1.1.1. There is a use-after-free when a server is disconnected during netsplits.

An issue was discovered in Irssi before 1.0.7 and 1.1.x before 1.1.1. There is a use-after-free when SASL messages are received in an unexpected order.

An issue was discovered in Irssi before 1.0.7 and 1.1.x before 1.1.1. When the number of windows exceeds the available space, a crash due to a NULL pointer...

An issue was discovered in Irssi before 1.0.7 and 1.1.x before 1.1.1. Certain nick names could result in out-of-bounds access when printing theme strings.

An issue was discovered in Irssi before 1.0.7 and 1.1.x before 1.1.1. A NULL pointer dereference occurs for an "empty" nick.

In Irssi before 1.0.6 a calculation error in the completion code could cause a heap buffer overflow when completing certain strings.

When using an incomplete variable argument, irssi before 1.0.6 may access data beyond the end of the string.

When the channel topic is set without specifying a sender, irssi before 1.0.6 may dereference a NULL pointer.

When using incomplete escape codes, irssi before 1.0.6 may access data beyond the end of the string.

Overlong nicks or targets may result in a NULL-pointer dereference in Irssi >= 0.8.17 and < 1.0.5 while splitting the message. Most IRC servers typically...

In certain cases Irssi may fail to verify that a Safe channel ID is long enough, causing reads beyond the end of the string. To be exploited, this issue...

Certain incorrectly formatted DCC CTCP messages could cause NULL- pointer dereference in Irssi < 1.0.5. This is a separate, but similar issue to...

When installing themes with unterminated colour formatting sequences, Irssi < 1.0.5 may access data beyond the end of the string.

While waiting for the channel synchronization, Irssi < 1.0.5 may incorrectly fail to remove destroyed channels from the query list, resulting in...

While updating the internal nick list, Irssi may incorrectly use the GHashTable interface and free the nick while updating it. This will then result in...

When receiving messages with invalid time stamps, Irssi would try to dereference a NULL pointer. This requires control over the IRC server, or a position of...

In Irssi before 1.0.3, when receiving certain incorrectly quoted DCC files, it tries to find the terminating quote one byte before the allocated memory....

In Irssi before 1.0.3, when receiving a DCC message without source nick/host, it attempts to dereference a NULL pointer. Thus, remote IRC servers can cause a crash.

A use after free vulnerability has been discovered in irssi < 1.0.2 while producing a list of netjoins that can result in arbitrary code execution.

An out of bounds read has been discovered in certain incomplete character sequences leading to application crash.

An out of bounds read has been discovered in certain incomplete control codes leading to application crash.

A use after free vulnerability has been discovered when receiving an invalid nick message potentially leading to arbitrary code execution.

A NULL pointer dereference has been discovered in the nickcmp function leading to application crash.

The format_send_to_gui() function does not validate the length of the string before incrementing the `ptr' pointer in all cases. If that happens, the...

The unformat_24bit_color() function is called by format_send_to_gui() to decode 24bit color codes into their components. The pointer is advanced...