<?xml version="1.0" encoding="UTF-8"?>
<cvrfdoc xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:cpe="http://cpe.mitre.org/language/2.0" xmlns:cvrf="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/cvrf" xmlns:cvrf-common="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/common" xmlns:cvssv2="http://scap.nist.gov/schema/cvss-v2/1.0" xmlns:cvssv3="https://www.first.org/cvss/cvss-v3.0.xsd" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:ns0="http://purl.org/dc/elements/1.1/" xmlns:prod="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/prod" xmlns:scap-core="http://scap.nist.gov/schema/scap-core/1.0" xmlns:sch="http://purl.oclc.org/dsdl/schematron" xmlns:vuln="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/vuln" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/cvrf">
  <DocumentTitle xml:lang="en">Security update for irssi</DocumentTitle>
  <DocumentType>SUSE Patch</DocumentType>
  <DocumentPublisher Type="Vendor">
    <ContactDetails>security@suse.de</ContactDetails>
    <IssuingAuthority>SUSE Security Team</IssuingAuthority>
  </DocumentPublisher>
  <DocumentTracking>
    <Identification>
      <ID>openSUSE-SU-2017:1515-1</ID>
    </Identification>
    <Status>Final</Status>
    <Version>1</Version>
    <RevisionHistory>
      <Revision>
        <Number>1</Number>
        <Date>2017-06-08T11:11:34Z</Date>
        <Description>current</Description>
      </Revision>
    </RevisionHistory>
    <InitialReleaseDate>2017-06-08T11:11:34Z</InitialReleaseDate>
    <CurrentReleaseDate>2017-06-08T11:11:34Z</CurrentReleaseDate>
    <Generator>
      <Engine>cve-database/bin/generate-cvrf.pl</Engine>
      <Date>2017-02-24T01:00:00Z</Date>
    </Generator>
  </DocumentTracking>
  <DocumentNotes>
    <Note Title="Topic" Type="Summary" Ordinal="1" xml:lang="en">Security update for irssi</Note>
    <Note Title="Details" Type="General" Ordinal="2" xml:lang="en">This update to irssi 1.0.3 fixes the following vulnerabilities:

- CVE-2017-9469: irssi: dcc crash with incorrect quoting (bsc#1043052)
- CVE-2017-9468: irssi: dcc message crash without nick/host (bsc#1043051)</Note>
    <Note Title="Terms of Use" Type="Legal Disclaimer" Ordinal="3" xml:lang="en">The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).</Note>
    <Note Title="Patchnames" Type="Details" Ordinal="4" xml:lang="en">openSUSE-2017-668</Note>
  </DocumentNotes>
  <DocumentDistribution xml:lang="en">Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0)</DocumentDistribution>
  <DocumentReferences>
    <Reference Type="Self">
      <URL/>
      <Description>E-Mail link for openSUSE-SU-2017:1515-1</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://www.suse.com/support/security/rating/</URL>
      <Description>SUSE Security Ratings</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://bugzilla.suse.com/1043051</URL>
      <Description>SUSE Bug 1043051</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://bugzilla.suse.com/1043052</URL>
      <Description>SUSE Bug 1043052</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://www.suse.com/security/cve/CVE-2017-9468/</URL>
      <Description>SUSE CVE CVE-2017-9468 page</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://www.suse.com/security/cve/CVE-2017-9469/</URL>
      <Description>SUSE CVE CVE-2017-9469 page</Description>
    </Reference>
  </DocumentReferences>
  <ProductTree xmlns="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/prod">
    <Branch Type="Product Family" Name="SUSE Package Hub 12">
      <Branch Type="Product Name" Name="SUSE Package Hub 12">
        <FullProductName ProductID="SUSE Package Hub 12" CPE="cpe:/o:suse:packagehub:12">SUSE Package Hub 12</FullProductName>
      </Branch>
    </Branch>
    <Branch Type="Product Version" Name="irssi-1.0.3-25.1">
      <FullProductName ProductID="irssi-1.0.3-25.1">irssi-1.0.3-25.1</FullProductName>
    </Branch>
    <Branch Type="Product Version" Name="irssi-devel-1.0.3-25.1">
      <FullProductName ProductID="irssi-devel-1.0.3-25.1">irssi-devel-1.0.3-25.1</FullProductName>
    </Branch>
    <Relationship ProductReference="irssi-1.0.3-25.1" RelationType="Default Component Of" RelatesToProductReference="SUSE Package Hub 12">
      <FullProductName ProductID="SUSE Package Hub 12:irssi-1.0.3-25.1">irssi-1.0.3-25.1 as a component of SUSE Package Hub 12</FullProductName>
    </Relationship>
    <Relationship ProductReference="irssi-devel-1.0.3-25.1" RelationType="Default Component Of" RelatesToProductReference="SUSE Package Hub 12">
      <FullProductName ProductID="SUSE Package Hub 12:irssi-devel-1.0.3-25.1">irssi-devel-1.0.3-25.1 as a component of SUSE Package Hub 12</FullProductName>
    </Relationship>
  </ProductTree>
  <vuln:Vulnerability xmlns="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/vuln" Ordinal="1">
    <Notes>
      <Note Title="Vulnerability Description" Type="General" Ordinal="1" xml:lang="en">In Irssi before 1.0.3, when receiving a DCC message without source nick/host, it attempts to dereference a NULL pointer. Thus, remote IRC servers can cause a crash.</Note>
    </Notes>
    <CVE>CVE-2017-9468</CVE>
    <ProductStatuses>
      <Status Type="Fixed">
        <ProductID>SUSE Package Hub 12:irssi-1.0.3-25.1</ProductID>
        <ProductID>SUSE Package Hub 12:irssi-devel-1.0.3-25.1</ProductID>
      </Status>
    </ProductStatuses>
    <Threats>
      <Threat Type="Impact">
        <Description>important</Description>
      </Threat>
    </Threats>
    <CVSSScoreSets>
      <ScoreSetV2>
        <BaseScoreV2>5</BaseScoreV2>
        <VectorV2>AV:N/AC:L/Au:N/C:N/I:N/A:P</VectorV2>
      </ScoreSetV2>
      <ScoreSetV3>
        <BaseScoreV3>7.5</BaseScoreV3>
        <VectorV3>CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H</VectorV3>
      </ScoreSetV3>
    </CVSSScoreSets>
    <Remediations>
      <Remediation Type="Vendor Fix">
        <Description xml:lang="en">To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
</Description>
        <URL/>
      </Remediation>
    </Remediations>
    <References>
      <Reference>
        <URL>https://www.suse.com/security/cve/CVE-2017-9468.html</URL>
        <Description>CVE-2017-9468</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/1043051</URL>
        <Description>SUSE Bug 1043051</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/1064540</URL>
        <Description>SUSE Bug 1064540</Description>
      </Reference>
    </References>
  </vuln:Vulnerability>
  <vuln:Vulnerability xmlns="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/vuln" Ordinal="2">
    <Notes>
      <Note Title="Vulnerability Description" Type="General" Ordinal="1" xml:lang="en">In Irssi before 1.0.3, when receiving certain incorrectly quoted DCC files, it tries to find the terminating quote one byte before the allocated memory. Thus, remote attackers might be able to cause a crash.</Note>
    </Notes>
    <CVE>CVE-2017-9469</CVE>
    <ProductStatuses>
      <Status Type="Fixed">
        <ProductID>SUSE Package Hub 12:irssi-1.0.3-25.1</ProductID>
        <ProductID>SUSE Package Hub 12:irssi-devel-1.0.3-25.1</ProductID>
      </Status>
    </ProductStatuses>
    <Threats>
      <Threat Type="Impact">
        <Description>important</Description>
      </Threat>
    </Threats>
    <CVSSScoreSets>
      <ScoreSetV2>
        <BaseScoreV2>5</BaseScoreV2>
        <VectorV2>AV:N/AC:L/Au:N/C:N/I:N/A:P</VectorV2>
      </ScoreSetV2>
      <ScoreSetV3>
        <BaseScoreV3>7.5</BaseScoreV3>
        <VectorV3>CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H</VectorV3>
      </ScoreSetV3>
    </CVSSScoreSets>
    <Remediations>
      <Remediation Type="Vendor Fix">
        <Description xml:lang="en">To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
</Description>
        <URL/>
      </Remediation>
    </Remediations>
    <References>
      <Reference>
        <URL>https://www.suse.com/security/cve/CVE-2017-9469.html</URL>
        <Description>CVE-2017-9469</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/1043052</URL>
        <Description>SUSE Bug 1043052</Description>
      </Reference>
    </References>
  </vuln:Vulnerability>
</cvrfdoc>
