CVE-2017-10966

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

An issue was discovered in Irssi before 1.0.4. While updating the internal nick list, Irssi could incorrectly use the GHashTable interface and free the nick while updating it. This would then result in use-after-free conditions on each access of the hash table.

Metrics

CVSS 3.0 9.8/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-416

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://github.com/irssi/irssi/commit/5e26325317c72a04c1610ad952974e206384d291Issue Tracking, Patch, Third Party Advisory
https://irssi.org/security/irssi_sa_2017_07.txtPatch, Vendor Advisory
https://www.debian.org/security/2017/dsa-4016
https://github.com/irssi/irssi/commit/5e26325317c72a04c1610ad952974e206384d291Issue Tracking, Patch, Third Party Advisory
https://irssi.org/security/irssi_sa_2017_07.txtPatch, Vendor Advisory
https://www.debian.org/security/2017/dsa-4016

Timeline

Published: Jul 7, 2017
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2017

CVE-2017-109676.1In FineCMS before 2017-07-06, application\core\controller\config.php allows XSS in the (1) key_name, (2) key_value, and (3) meaning paramete CVE-2017-109689.8In FineCMS through 2017-07-07, application\core\controller\template.php allows remote PHP code execution by placing the code after "<?php" i CVE-2017-10978.8IBM Emptoris Strategic Supply Management Platform 10.0.0.x through 10.1.1.x is vulnerable to cross-site request forgery which could allow an CVE-2017-109705.4Cross-site scripting (XSS) vulnerability in link.php in Cacti 1.1.12 allows remote anonymous users to inject arbitrary web script or HTML vi CVE-2017-109718.8In the X.Org X server before 2017-06-19, a user authenticated to an X Session could crash or execute code in the context of the X Server by CVE-2017-109726.5Uninitialized data in endianness conversion in the XEvent handling of the X.Org X Server before 2017-06-19 allowed authenticated malicious u CVE-2017-109736.5In FineCMS before 2017-07-06, application/lib/ajax/get_image_data.php has SSRF, related to requests for non-image files with a modified HTTP CVE-2017-109747.5Yaws 1.91 allows Unauthenticated Remote File Disclosure via HTTP Directory Traversal with /%5C../ to port 8080. NOTE: this CVE is only about CVE-2017-109756.1Cross-site scripting (XSS) vulnerability in Lutim before 0.8 might allow remote attackers to inject arbitrary web script or HTML via a craft CVE-2017-109767.5When SWFTools 0.9.2 processes a crafted file in ttftool, it can lead to a heap-based buffer over-read in the readBlock() function in lib/ttf CVE-2017-109787.5An FR-GV-201 issue in FreeRADIUS 2.x before 2.2.10 and 3.x before 3.0.15 allows "Read / write overflow in make_secret()" and a denial of ser CVE-2017-109799.8An FR-GV-202 issue in FreeRADIUS 2.x before 2.2.10 allows "Write overflow in rad_coalesce()" - this allows remote attackers to cause a denia