summaryrefslogtreecommitdiffstats
path: root/package/irssi
Commit message (Collapse)AuthorAgeFilesLines
* irssi: security bump to version 1.0.7Peter Korsgaard2018-03-182-2/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | Fixes the following security issues: Use after free when server is disconnected during netsplits. Incomplete fix of CVE-2017-7191. Found by Joseph Bisch. (CWE-416, CWE-825) - CVE-2018-7054 [2] was assigned to this issue. Use after free when SASL messages are received in unexpected order. Found by Joseph Bisch. (CWE-416, CWE-691) - CVE-2018-7053 [3] was assigned to this issue. Null pointer dereference when an “empty” nick has been observed by Irssi. Found by Joseph Bisch. (CWE-476, CWE-475) - CVE-2018-7050 [4] was assigned to this issue. When the number of windows exceed the available space, Irssi would crash due to Null pointer dereference. Found by Joseph Bisch. (CWE-690) - CVE-2018-7052 [5] was assigned to this issue. Certain nick names could result in out of bounds access when printing theme strings. Found by Oss-Fuzz. (CWE-126) - CVE-2018-7051 [6] was assigned to this issue. Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
* irssi: security bump to version 1.0.6Peter Korsgaard2018-01-072-2/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | >From the advisory (https://irssi.org/security/irssi_sa_2018_01.txt): Multiple vulnerabilities have been located in Irssi. (a) When the channel topic is set without specifying a sender, Irssi may dereference NULL pointer. Found by Joseph Bisch. (CWE-476) CVE-2018-5206 was assigned to this issue. (b) When using incomplete escape codes, Irssi may access data beyond the end of the string. (CWE-126) Found by Joseph Bisch. CVE-2018-5205 was assigned to this issue. (c) A calculation error in the completion code could cause a heap buffer overflow when completing certain strings. (CWE-126) Found by Joseph Bisch. CVE-2018-5208 was assigned to this issue. (d) When using an incomplete variable argument, Irssi may access data beyond the end of the string. (CWE-126) Found by Joseph Bisch. CVE-2018-5207 was assigned to this issue. Signed-off-by: Peter Korsgaard <peter@korsgaard.com> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
* irssi: security bump to version 1.0.5Peter Korsgaard2017-10-252-2/+4
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Fixes the following security issues: (a) When installing themes with unterminated colour formatting sequences, Irssi may access data beyond the end of the string. (CWE-126) Found by Hanno Böck. CVE-2017-15228 was assigned to this issue. (b) While waiting for the channel synchronisation, Irssi may incorrectly fail to remove destroyed channels from the query list, resulting in use after free conditions when updating the state later on. Found by Joseph Bisch. (CWE-416 caused by CWE-672) CVE-2017-15227 was assigned to this issue. (c) Certain incorrectly formatted DCC CTCP messages could cause NULL pointer dereference. Found by Joseph Bisch. This is a separate, but similar issue to CVE-2017-9468. (CWE-690) CVE-2017-15721 was assigned to this issue. (d) Overlong nicks or targets may result in a NULL pointer dereference while splitting the message. Found by Joseph Bisch. (CWE-690) CVE-2017-15723 was assigned to this issue. (e) In certain cases Irssi may fail to verify that a Safe channel ID is long enough, causing reads beyond the end of the string. Found by Joseph Bisch. (CWE-126) CVE-2017-15722 was assigned to this issue. For more details, see the advisory: https://irssi.org/security/irssi_sa_2017_10.txt While we're at it, also add a hash for the license file. Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
* irssi: security bump to version 1.0.4Peter Korsgaard2017-07-082-2/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | >From the advisory: https://irssi.org/security/irssi_sa_2017_07.txt Two vulnerabilities have been located in Irssi. (a) When receiving messages with invalid time stamps, Irssi would try to dereference a NULL pointer. Found by Brian 'geeknik' Carpenter of Geeknik Labs. (CWE-690) CVE-2017-10965 [2] was assigned to this bug (b) While updating the internal nick list, Irssi may incorrectly use the GHashTable interface and free the nick while updating it. This will then result in use-after-free conditions on each access of the hash table. Found by Brian 'geeknik' Carpenter of Geeknik Labs. (CWE-416 caused by CWE-227) CVE-2017-10966 [3] was assigned to this bug Impact ------ (a) May result in denial of service (remote crash). (b) Undefined behaviour. Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
* irssi: drop obsolete configure optionRodrigo Rebello2017-06-191-1/+0
| | | | | | | | The configure option --with-ncurses has been removed in version 1.0.0 and thus is no longer needed. Signed-off-by: Rodrigo Rebello <rprebello@gmail.com> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
* irssi: security bump to version 1.0.3Peter Korsgaard2017-06-193-82/+2
| | | | | | | | | | | | | | | | | | | | | | Fixes: CVE-2017-9468 - Joseph Bisch discovered that Irssi does not properly handle DCC messages without source nick/host. A malicious IRC server can take advantage of this flaw to cause Irssi to crash, resulting in a denial of service. CVE-2017-9469 - Joseph Bisch discovered that Irssi does not properly handle receiving incorrectly quoted DCC files. A remote attacker can take advantage of this flaw to cause Irssi to crash, resulting in a denial of service. See https://irssi.org/security/irssi_sa_2017_06.txt for more details. Remove 0001-Get-back-to-using-pkg-config-to-check-for-OpenSSL.patch as it applied upstream and drop autoreconf as configure.ac is no longer patched. Signed-off-by: Peter Korsgaard <peter@korsgaard.com> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
* irssi: fix attributes ordering in Config.inRodrigo Rebello2017-04-121-3/+3
| | | | | | | | | | According to the Buildroot convention, 'depends on' attributes shall come before 'select' ones in Kconfig files. Detected by check-package. Signed-off-by: Rodrigo Rebello <rprebello@gmail.com> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
* boot, linux, package: use SPDX short identifier for GPLv2/GPLv2+Rahul Bedarkar2017-04-011-1/+1
| | | | | | | | | | | We want to use SPDX identifier for license strings as much as possible. SPDX short identifier for GPLv2/GPLv2+ is GPL-2.0/GPL-2.0+. This change is done by using following command. find . -name "*.mk" | xargs sed -ri '/LICENSE( )?[\+:]?=/s/\<GPLv2\>/GPL-2.0/g' Signed-off-by: Rahul Bedarkar <rahulbedarkar89@gmail.com> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
* irssi: add patch to fix static linkingRodrigo Rebello2017-03-212-0/+80
| | | | | | | | | | | | | | | | | | | | | | | | An upstream change which removed the option to build Irssi without SSL support (v1.0.0 and later) also eliminated the use of PKG_CHECK_MODULES to find the OpenSSL library, relying only on a test with AC_CHECK_LIB for that purpose. This unfortunately broke static linking since the flag to link with zlib, used by OpenSSL, is missed completely. The newly added patch therefore adds PKG_CHECK_MODULES back into the configure script. Fixes: http://autobuild.buildroot.net/results/e8b51f65525246d1205a26859d418393aaebf48c/ http://autobuild.buildroot.net/results/35d952b3b36e295723bf8ed1badb4c9439201822/ http://autobuild.buildroot.net/results/ea8af1458edf3ce0e2b1c444d2ae29ac1e5d2fbf/ [...] Signed-off-by: Rodrigo Rebello <rprebello@gmail.com> Reviewed-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
* irssi: bump version to version 1.0.2Peter Korsgaard2017-03-153-10/+4
| | | | | | | | | | | | | | | | | | | | | | | | | | Notice that this fixes a security issue: CWE-416 (use after free condition during netjoin processing). No CVE assigned yet: https://irssi.org/security/irssi_sa_2017_03.txt But the 0.8.x series is not believed to be vulnerable to this specific issue. From the advisory: Affected versions ----------------- Irssi up to and including 1.0.1 We believe Irssi 0.8.21 and prior are not affected since a different code path causes the netjoins to be flushed prior to reaching the use after free condition. Openssl is no longer optional, so select it and drop the enable/disable handling. Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
* irssi: security bump to 0.8.21Peter Korsgaard2017-01-062-2/+2
| | | | | | | | | | | | | | | | | | | Bugfixes: - CVE-2017-5193: Correct a NULL pointer dereference in the nickcmp function found by Joseph Bisch (GL#1) - CVE-2017-5194: Correct an error when receiving invalid nick message (GL#4, #466) - CVE-2017-5195: Correct an out of bounds read in certain incomplete control codes found by Joseph Bisch (GL#2) - CVE-2017-5196: Correct an out of bounds read in certain incomplete character sequences found by Hanno Böck and independently by J. Bisch (GL#3) Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
* irssi: security bump to version 0.8.20Gustavo Zacarias2016-09-252-2/+2
| | | | | | | Fixes two remote crash issues since version 0.8.17 Signed-off-by: Gustavo Zacarias <gustavo@zacarias.com.ar> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
* irssi: bump to version 0.8.19Rodrigo Rebello2016-08-162-2/+2
| | | | | Signed-off-by: Rodrigo Rebello <rprebello@gmail.com> Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
* irssi: bump to version 0.8.18Rodrigo Rebello2016-03-083-51/+4
| | | | | | | Also remove no longer needed patch (merged upstream). Signed-off-by: Rodrigo Rebello <rprebello@gmail.com> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
* irssi: update download URLRodrigo Rebello2015-12-171-1/+3
| | | | | | | Irssi source packages are now hosted on GitHub. Signed-off-by: Rodrigo Rebello <rprebello@gmail.com> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
* irssi: change IRSSI_SITE back to original urlRodrigo Rebello2015-11-041-3/+1
| | | | | | | The official site is now back online. Signed-off-by: Rodrigo Rebello <rprebello@gmail.com> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
* irssi: add missing dependency on host-pkgconfRodrigo Rebello2015-11-031-1/+1
| | | | | | | | The irssi configure script uses pkg-config to detect the availability of libglib2 and openssl. Signed-off-by: Rodrigo Rebello <rprebello@gmail.com> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
* irssi: new packageRodrigo Rebello2015-11-024-0/+132
Irssi is a terminal based IRC client for UNIX systems. http://irssi.org/ [Thomas: use alternate site since the official site is currently down.] Signed-off-by: Rodrigo Rebello <rprebello@gmail.com> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
OpenPOWER on IntegriCloud