CVE-2017-5356

Irssi en versiones anteriores a 0.8.21 permite a atacantes remotos provocar una denegación de servicio (lectura fuera de límites y caída) a través de una cadena que contiene una secuencia de formato (%[) sin un cierre de paréntesis (]).

It was discovered that the Irssi buf.pl script set incorrect permissions. A local attacker could use this issue to retrieve another user's window contents. Joseph Bisch discovered that Irssi incorrectly handled comparing nicks. A remote attacker could use this issue to cause Irssi to crash, resulting in a denial of service, or possibly execute arbitrary code. It was discovered that Irssi incorrectly handled invalid nick messages. A remote attacker could use this issue to cause Irssi to crash, resulting in a denial of service, or possibly execute arbitrary code. Various other issues were also addressed.