CVE-2018-7053

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

An issue was discovered in Irssi before 1.0.7 and 1.1.x before 1.1.1. There is a use-after-free when SASL messages are received in an unexpected order.

Metrics

CVSS 3.0 9.8/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-416

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://openwall.com/lists/oss-security/2018/02/15/1Mailing List, Third Party Advisory
https://irssi.org/security/irssi_sa_2018_02.txtMitigation, Vendor Advisory
https://usn.ubuntu.com/3590-1/Third Party Advisory
https://www.debian.org/security/2018/dsa-4162Third Party Advisory
http://openwall.com/lists/oss-security/2018/02/15/1Mailing List, Third Party Advisory
https://irssi.org/security/irssi_sa_2018_02.txtMitigation, Vendor Advisory
https://usn.ubuntu.com/3590-1/Third Party Advisory
https://www.debian.org/security/2018/dsa-4162Third Party Advisory

Timeline

Published: Feb 15, 2018
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2018

CVE-2018-70549.8An issue was discovered in Irssi before 1.0.7 and 1.1.x before 1.1.1. There is a use-after-free when a server is disconnected during netspli CVE-2018-70557.5GroupViewProxyServlet in RoomWizard before 4.4.x allows SSRF via the url parameter.CVE-2018-70565.3RoomWizard before 4.4.x allows remote attackers to obtain potentially sensitive information about IP addresses via /getGroupTimeLineJSON.act CVE-2018-70576.1RoomWizard before 4.4.x allows XSS via the HelpAction.action pageName parameter.CVE-2018-70589.8Aruba ClearPass, all versions of 6.6.x prior to 6.6.9 are affected by an authentication bypass vulnerability, an attacker can leverage this CVE-2018-70598.8Aruba ClearPass prior to 6.6.9 has a vulnerability in the API that helps to coordinate cluster actions. An authenticated user with the "mon"CVE-2018-70608.8Aruba ClearPass 6.6.x prior to 6.6.9 and 6.7.x prior to 6.7.1 is vulnerable to CSRF attacks against authenticated users. An attacker could m CVE-2018-70638.1In Aruba ClearPass, disabled API admins can still perform read/write operations. In certain circumstances, API admins in ClearPass which hav CVE-2018-70646.1A reflected cross-site scripting (XSS) vulnerability is present in an unauthenticated Aruba Instant web interface. An attacker could use thi CVE-2018-70657.2An authenticated SQL injection vulnerability in Aruba ClearPass Policy Manager can lead to privilege escalation. All versions of ClearPass a CVE-2018-70669.0An unauthenticated remote command execution exists in Aruba ClearPass Policy Manager on linked devices. The ClearPass OnConnect feature perm CVE-2018-70677.2A Remote Authentication bypass in Aruba ClearPass Policy Manager leads to complete cluster compromise. An authentication flaw in all version