CVE-2017-15228 - OpenCVE

Irssi before 1.0.5, when installing themes with unterminated colour formatting sequences, may access data beyond the end of the string.

No CVSS v4.0

No CVSS v3.1

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

Access Vector Network

Access Complexity Low

Authentication None

Confidentiality Impact None

Integrity Impact None

Availability Impact Partial

AV:N/AC:L/Au:N/C:N/I:N/A:P

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Irssi	Irssi

Configuration 1 [-]

cpe:2.3:a:irssi:irssi:*:*:*:*:*:*:*:*

No data.

References

Link	Providers
http://openwall.com/lists/oss-security/2017/10/22/4
https://irssi.org/security/irssi_sa_2017_10.txt
https://lists.debian.org/debian-lts-announce/2017/12/msg00022.html
https://nvd.nist.gov/vuln/detail/CVE-2017-15228
https://www.cve.org/CVERecord?id=CVE-2017-15228
https://www.debian.org/security/2017/dsa-4016

History

No history.

MITRE

Status: PUBLISHED

Assigner: mitre

Published: 2017-10-22T17:00:00

Updated: 2024-08-05T19:50:16.405Z

Reserved: 2017-10-10T00:00:00

Link: CVE-2017-15228

Vulnrichment

No data.

NVD

Status : Modified

Published: 2017-10-22T20:29:00.273

Modified: 2018-02-04T02:29:11.130

Link: CVE-2017-15228

Redhat

Severity : Moderate

Publid Date: 2017-10-22T00:00:00Z

Links: CVE-2017-15228 - Bugzilla

{"containers": {"cna": {"affected": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "datePublic": "2017-10-22T00:00:00", "descriptions": [{"lang": "en", "value": "Irssi before 1.0.5, when installing themes with unterminated colour formatting sequences, may access data beyond the end of the string."}], "problemTypes": [{"descriptions": [{"description": "n/a", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2018-02-02T10:57:01", "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre"}, "references": [{"name": "DSA-4016", "tags": ["vendor-advisory", "x_refsource_DEBIAN"], "url": "https://www.debian.org/security/2017/dsa-4016"}, {"name": "[debian-lts-announce] 20171223 [SECURITY] [DLA 1217-1] irssi security update", "tags": ["mailing-list", "x_refsource_MLIST"], "url": "https://lists.debian.org/debian-lts-announce/2017/12/msg00022.html"}, {"tags": ["x_refsource_CONFIRM"], "url": "https://irssi.org/security/irssi_sa_2017_10.txt"}, {"tags": ["x_refsource_CONFIRM"], "url": "http://openwall.com/lists/oss-security/2017/10/22/4"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "cve@mitre.org", "ID": "CVE-2017-15228", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "n/a", "version": {"version_data": [{"version_value": "n/a"}]}}]}, "vendor_name": "n/a"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "Irssi before 1.0.5, when installing themes with unterminated colour formatting sequences, may access data beyond the end of the string."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "n/a"}]}]}, "references": {"reference_data": [{"name": "DSA-4016", "refsource": "DEBIAN", "url": "https://www.debian.org/security/2017/dsa-4016"}, {"name": "[debian-lts-announce] 20171223 [SECURITY] [DLA 1217-1] irssi security update", "refsource": "MLIST", "url": "https://lists.debian.org/debian-lts-announce/2017/12/msg00022.html"}, {"name": "https://irssi.org/security/irssi_sa_2017_10.txt", "refsource": "CONFIRM", "url": "https://irssi.org/security/irssi_sa_2017_10.txt"}, {"name": "http://openwall.com/lists/oss-security/2017/10/22/4", "refsource": "CONFIRM", "url": "http://openwall.com/lists/oss-security/2017/10/22/4"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-05T19:50:16.405Z"}, "title": "CVE Program Container", "references": [{"name": "DSA-4016", "tags": ["vendor-advisory", "x_refsource_DEBIAN", "x_transferred"], "url": "https://www.debian.org/security/2017/dsa-4016"}, {"name": "[debian-lts-announce] 20171223 [SECURITY] [DLA 1217-1] irssi security update", "tags": ["mailing-list", "x_refsource_MLIST", "x_transferred"], "url": "https://lists.debian.org/debian-lts-announce/2017/12/msg00022.html"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://irssi.org/security/irssi_sa_2017_10.txt"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "http://openwall.com/lists/oss-security/2017/10/22/4"}]}]}, "cveMetadata": {"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "cveId": "CVE-2017-15228", "datePublished": "2017-10-22T17:00:00", "dateReserved": "2017-10-10T00:00:00", "dateUpdated": "2024-08-05T19:50:16.405Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:irssi:irssi:*:*:*:*:*:*:*:*", "matchCriteriaId": "9E81D7B5-7308-446B-A190-AB9D9813C33F", "versionEndIncluding": "1.0.4", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Irssi before 1.0.5, when installing themes with unterminated colour formatting sequences, may access data beyond the end of the string."}, {"lang": "es", "value": "Irssi en versiones anteriores a la 1.0.5, cuando instala temas con secuencias de formato de color indeterminado, podr\u00eda acceder a datos m\u00e1s all\u00e1 del fin de la cadena."}], "id": "CVE-2017-15228", "lastModified": "2018-02-04T02:29:11.130", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 5.0, "confidentialityImpact": "NONE", "integrityImpact": "NONE", "vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV30": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.0"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2017-10-22T20:29:00.273", "references": [{"source": "cve@mitre.org", "tags": ["Mailing List", "Mitigation", "Patch", "Third Party Advisory"], "url": "http://openwall.com/lists/oss-security/2017/10/22/4"}, {"source": "cve@mitre.org", "tags": ["Mitigation", "Patch", "Vendor Advisory"], "url": "https://irssi.org/security/irssi_sa_2017_10.txt"}, {"source": "cve@mitre.org", "url": "https://lists.debian.org/debian-lts-announce/2017/12/msg00022.html"}, {"source": "cve@mitre.org", "url": "https://www.debian.org/security/2017/dsa-4016"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-125"}], "source": "nvd@nist.gov", "type": "Primary"}]}