Vulnerability CVE-2019-5882

Vulnerability Name:

CVE-2019-5882 (CCN-155414)

Assigned:

2019-01-09

Published:

2019-01-09

Updated:

2019-02-26

Summary:

Irssi 1.1.x before 1.1.2 has a use after free when hidden lines are expired from the scroll buffer.

CVSS v3 Severity:

9.8 Critical (CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
8.5 High (Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C)

Exploitability Metrics:	Attack Vector (AV): Network Attack Complexity (AC): Low Privileges Required (PR): None User Interaction (UI): None
Scope:	Scope (S): Unchanged
Impact Metrics:	Confidentiality (C): High Integrity (I): High Availibility (A): High

5.3 Medium (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)
4.6 Medium (CCN Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:U/RL:O/RC:C)

Exploitability Metrics:	Attack Vector (AV): Network Attack Complexity (AC): Low Privileges Required (PR): None User Interaction (UI): None
Scope:	Scope (S): Unchanged
Impact Metrics:	Confidentiality (C): None Integrity (I): None Availibility (A): Low

CVSS v2 Severity:

7.5 High (CVSS v2 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P)

Exploitability Metrics:	Access Vector (AV): Network Access Complexity (AC): Low Authentication (Au): None
Impact Metrics:	Confidentiality (C): Partial Integrity (I): Partial Availibility (A): Partial

5.0 Medium (CCN CVSS v2 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P)

Exploitability Metrics:	Access Vector (AV): Network Access Complexity (AC): Low Athentication (Au): None
Impact Metrics:	Confidentiality (C): None Integrity (I): None Availibility (A): Partial

Vulnerability Type:

CWE-416

Vulnerability Consequences:

Denial of Service

References:

Source: MITRE
Type: CNA
CVE-2019-5882

Source: XF
Type: UNKNOWN
irssi-cve20195882-dos(155414)

Source: MISC
Type: Patch, Third Party Advisory
https://github.com/irssi/irssi/pull/948

Source: CCN
Type: Irssi Web site
Irssi

Source: MISC
Type: Vendor Advisory
https://irssi.org/NEWS/#v1-1-2

Source: MISC
Type: Vendor Advisory
https://irssi.org/security/irssi_sa_2019_01.txt

Source: CCN
Type: oss-sec Mailing List, Thu, 10 Jan 2019 00:21:04 +0100
Irssi 1.1.2: CVE-2019-5882

Source: UBUNTU
Type: Third Party Advisory
USN-3862-1

Source: CCN
Type: WhiteSource Vulnerability Database
CVE-2019-5882

Vulnerable Configuration:

Configuration 1:

cpe:/a:irssi:irssi:*:*:*:*:*:*:*:* (Version >= 1.1.0 and < 1.1.2)

Configuration 2:

cpe:/o:canonical:ubuntu_linux:14.04:*:*:*:lts:*:*:*

OR cpe:/o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:*

OR cpe:/o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*

OR cpe:/o:canonical:ubuntu_linux:18.10:*:*:*:*:*:*:*

Configuration CCN 1:

cpe:/a:irssi:irssi:1.1.1:*:*:*:*:*:*:*

Denotes that component is vulnerable

Oval Definitions

Definition ID	Class	Title	Last Modified
oval:org.opensuse.security:def:20195882	V	CVE-2019-5882	2022-06-30
oval:org.opensuse.security:def:112443	P	irssi-1.2.3-2.4 on GA media (Moderate)	2022-01-17
oval:org.opensuse.security:def:105949	P	irssi-1.2.3-2.4 on GA media (Moderate)	2021-10-01
oval:org.opensuse.security:def:26466	P	Security update for irssi (Important)	2020-12-01
oval:org.opensuse.security:def:25444	P	Security update for sysstat (Moderate)	2020-12-01
oval:org.opensuse.security:def:25749	P	Security update for pidgin (Moderate)	2020-12-01
oval:org.opensuse.security:def:25222	P	Security update for java-1_8_0-openjdk (Important)	2020-12-01
oval:org.opensuse.security:def:25594	P	Security update for targetcli-fb (Moderate)	2020-12-01
oval:org.opensuse.security:def:25020	P	Security update for ibus (Important)	2020-12-01
oval:org.opensuse.security:def:25793	P	Security update for icedtea-web (Moderate)	2020-12-01
oval:org.opensuse.security:def:25303	P	Security update for xorg-x11-server (Important)	2020-12-01
oval:org.opensuse.security:def:25647	P	Security update for freetype2 (Important)	2020-12-01
oval:org.opensuse.security:def:25031	P	Security update for gpg2 (Moderate)	2020-12-01
oval:org.opensuse.security:def:26431	P	Security update for tor (Moderate)	2020-12-01
oval:org.opensuse.security:def:25360	P	Security update for xrdp (Important)	2020-12-01
oval:org.opensuse.security:def:25735	P	Security update for exiv2 (Moderate)	2020-12-01
oval:org.opensuse.security:def:25095	P	Security update for mariadb-100 (Moderate)	2020-12-01
oval:com.ubuntu.xenial:def:201958820000000	V	CVE-2019-5882 on Ubuntu 16.04 LTS (xenial) - medium.	2019-01-09
oval:com.ubuntu.bionic:def:20195882000	V	CVE-2019-5882 on Ubuntu 18.04 LTS (bionic) - medium.	2019-01-09
oval:com.ubuntu.cosmic:def:20195882000	V	CVE-2019-5882 on Ubuntu 18.10 (cosmic) - medium.	2019-01-09
oval:com.ubuntu.cosmic:def:201958820000000	V	CVE-2019-5882 on Ubuntu 18.10 (cosmic) - medium.	2019-01-09
oval:com.ubuntu.trusty:def:20195882000	V	CVE-2019-5882 on Ubuntu 14.04 LTS (trusty) - medium.	2019-01-09
oval:com.ubuntu.bionic:def:201958820000000	V	CVE-2019-5882 on Ubuntu 18.04 LTS (bionic) - medium.	2019-01-09
oval:com.ubuntu.xenial:def:20195882000	V	CVE-2019-5882 on Ubuntu 16.04 LTS (xenial) - medium.	2019-01-09

BACK