Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 594724 (CVE-2016-7044, CVE-2016-7045) - <net-irc/irssi-0.8.20-r1: Heap corruption and missing boundary checks
Summary: <net-irc/irssi-0.8.20-r1: Heap corruption and missing boundary checks
Alias: CVE-2016-7044, CVE-2016-7045
Product: Gentoo Security
Classification: Unclassified
Component: Vulnerabilities (show other bugs)
Hardware: All Linux
: Normal normal (vote)
Assignee: Gentoo Security
Whiteboard: B3 [noglsa cve]
Depends on:
Reported: 2016-09-21 19:55 UTC by Matthew Thode ( prometheanfire )
Modified: 2016-11-11 12:56 UTC (History)
2 users (show)

See Also:
Package list:
Runtime testing required: ---


Note You need to log in before you can comment on or make changes to this bug.
Description Matthew Thode ( prometheanfire ) archtester Gentoo Infrastructure gentoo-dev Security 2016-09-21 19:55:31 UTC

heap corruption and missing boundary checks
CWE Classification: CWE-20, CWE-823, CWE-126, CWE-122

CVE-2016-7044 [1] was assigned to bug 1
CVE-2016-7045 [2] was assigned to bug 2


Gabriel Campana and Adrien Guinet from Quarkslab reported two remote
crash and heap corruption vulnerabilites in Irssi's format parsing

They also provided us with proof of concept exploit code and patches
to fix those issues.


Remote crash and heap corruption. Remote code execution seems
difficult since only Nuls are written.

Detailed analysis

Based on analysis Provided by Gabriel Campana and Adrien Guinet from

Bug 1

The unformat_24bit_color() function is called by format_send_to_gui()
to decode 24bit color codes into their components. The pointer is
advanced unconditionally without checking if a complete code was

Thus, after the return of unformat_24bit_color(), ptr might be invalid
and point out of the buffer.

Bug 2

The format_send_to_gui() function does not validate the length of the
string before incrementing the `ptr' pointer in all cases.

If that happens, the pointer `ptr' can be incremented twice and thus
end past the boundaries of the original `dup' buffer.

Affected versions

Irssi 0.8.17-beta up to and including 0.8.19 up to 0.8.19-219-g52fedea

Bug 1 affects only Irssis compiled with true-color enabled.
Bug 2 affects all Irssis regardless of compilation flags.

Fixed in

Irssi 0.8.20

Recommended action

Upgrade to Irssi 0.8.20. Irssi 0.8.20 is a maintenance release
without any new features.

After installing the updated packages, one can issue the /upgrade
command to load the new binary. TLS connections will require
/reconnect. If the script is loaded and symlinked into
~/.irssi/scripts/autorun, text buffer content will be saved and

Fallback action

Distributions which need to remain on Irssi 0.8.17 are strongly urged
to apply the patch and provide updated packages.

Those who cannot upgrade right now, but with Perl support enabled in
their Irssi, can load the following script and add it to
~/.irssi/scripts/autorun as a first aid to mitigating these issues:


Comment 1 Matthew Thode ( prometheanfire ) archtester Gentoo Infrastructure gentoo-dev Security 2016-09-21 19:58:12 UTC
arches, please quick stabilize =net-irc/irssi-0.8.20 for the bug

@security - Not sure if it should be A3 or B3
Comment 2 Agostino Sarubbo gentoo-dev 2016-09-21 21:46:26 UTC
amd64 stable
Comment 3 Agostino Sarubbo gentoo-dev 2016-09-21 21:46:53 UTC
x86 stable
Comment 4 Tobias Klausmann (RETIRED) gentoo-dev 2016-09-22 10:58:21 UTC
Stable on alpha.
Comment 5 Jeroen Roovers (RETIRED) gentoo-dev 2016-09-23 13:31:59 UTC
Stable for HPPA PPC64.
Comment 6 Agostino Sarubbo gentoo-dev 2016-09-29 09:38:46 UTC
sparc stable
Comment 7 Agostino Sarubbo gentoo-dev 2016-09-29 12:39:40 UTC
ppc stable
Comment 8 Agostino Sarubbo gentoo-dev 2016-09-29 13:15:30 UTC
arm stable
Comment 9 Agostino Sarubbo gentoo-dev 2016-09-29 13:32:06 UTC
ia64 stable.

Maintainer(s), please cleanup.
Security, please add it to the existing request, or file a new one.
Comment 10 Patrice Clement gentoo-dev 2016-09-29 13:39:15 UTC
I think it'd have made more sense to stabilise -r1 since it includes another fix for another CVE (including the fix for the current bug). See bug 595172.

Does someone mind if I mark -r1 stable via the ALLARCHES policy and clean up versions < -r1? so that we can kill two birds in one stone.
Comment 11 Sven Wegener gentoo-dev 2016-09-30 17:01:19 UTC
I've just ported the keyword and performed a cleanup.
Comment 12 Aaron Bauman Gentoo Infrastructure gentoo-dev Security 2016-11-11 12:56:51 UTC
No proofing of arbitrary code execution in this as mentioned by the CWE.  Re-designating.

GLSA Vote: No