CVSS: 6.8EPSS: 0%CPEs: 24EXPL: 0CVE-2010-1155
https://notcve.org/view.php?id=CVE-2010-1155
Irssi before 0.8.15, when SSL is used, does not verify that the server hostname matches a domain name in the subject's Common Name (CN) field or a Subject Alternative Name field of the X.509 certificate, which allows man-in-the-middle attackers to spoof IRC servers via an arbitrary certificate. Irssi anterior v0.8.15, cuando usa SSL, no verifica que el servidor de nombres coincide con un nombre de dominio en el campo "subject" del Common Name (CN) o en un campo Subject Alternative Name del certifiado X.509, lo que permite a atacantes man-in-the-middel falsificar servidores IRC a través de un certificado de su elección. • http://github.com/ensc/irssi-proxy/commit/85bbc05b21678e80423815d2ef1dfe26208491ab http://irssi.org/news http://irssi.org/news/ChangeLog http://lists.fedoraproject.org/pipermail/package-announce/2010-May/041054.html http://lists.opensuse.org/opensuse-security-announce/2010-05/msg00001.html http://marc.info/?l=oss-security&m=127098845125270&w=2 http://marc.info/?l=oss-security&m=127110132019166&w=2 http://marc.info/?l=oss-security&m=127116251220784&w=2 http://marc.info/?l=oss- • CWE-20: Improper Input Validation •
CVSS: 5.0EPSS: 5%CPEs: 1EXPL: 4CVE-2009-1959 – Irssi 0.8.13 - 'WALLOPS' Message Off-by-One Heap Memory Corruption
https://notcve.org/view.php?id=CVE-2009-1959
Off-by-one error in the event_wallops function in fe-common/irc/fe-events.c in irssi 0.8.13 allows remote IRC servers to cause a denial of service (crash) via an empty command, which triggers a one-byte buffer under-read and a one-byte buffer underflow. Error de superación de límite (Off-by-one) en loa función event_wallops en fe-common/irc/fe-events.c en irssi v0.8.13, permite a los servidores de IRC remotos provocar una denegación de servicio (caída) a través de un comando vacío, lo que lanza un lectura de búfer por debajo de un byte (one-byte) o por el desbordamiento de búfer inferior de un byte (one-byte). • https://www.exploit-db.com/exploits/33041 http://bugs.irssi.org/index.php?do=details&task_id=662 http://lists.opensuse.org/opensuse-security-announce/2009-07/msg00002.html http://secunia.com/advisories/35685 http://secunia.com/advisories/35812 http://secunia.com/advisories/36152 http://www.irssi.org/ChangeLog http://www.mandriva.com/security/advisories?name=MDVSA-2009:133 http://www.openwall.com/lists/oss-security/2009/05/29/3 http://www.securityfocus.com/bid/35399 htt • CWE-189: Numeric Errors •