CVE-2016-7553

What it actually does

The buf.pl script creates a scrollbuffer dump file with permissions that allow any local user to read its contents, exposing private chat logs stored during Irssi upgrades.

Why it matters to the business

Organizations using affected Irssi installations risk unauthorized local access to sensitive internal or customer conversation logs, potentially leading to privacy incidents or compliance issues, though the flaw is old and has low observed exploitation.

How an attack unfolds

An attacker with local access on a system running vulnerable Irssi waits for the buf.pl script to generate the dump file during an upgrade window, then reads the file to retrieve private chat history; no remote exploitation or named threat actors are associated with this issue.

How to fix it

Upgrade to the fixed versions: scorecard (Chainguard) 4.13.1-r2 or later, scorecard (Wolfi) 4.13.1-r2 or later, or irssi/scripts.irssi.org commit f1b1eb154baa684fad5d65bf4dff79c8ded8b65a; restrict permissions on any existing dump files and ensure the script runs with umask that prevents world-readable files.

How to confirm the fix worked

Verify installed package versions against the listed fixed releases, inspect the permissions of any scrollbuffer dump files (should not be world-readable), and confirm the buf.pl script in use is version 2.20 or newer.

Typical attack path

1. Gain local user access on a host running vulnerable Irssi
2. Trigger or wait for buf.pl to create the scrollbuffer dump file
3. Read the file using standard file system access to extract chat contents

How to detect it

Review file system permissions and ownership of any Irssi scrollbuffer or dump files created during upgrades; check system logs or audit trails for unexpected local reads of files in user home directories or Irssi configuration paths.

What your security team should do

• Apply the listed fixed versions immediately on all Irssi deployments
• Audit local file permissions on chat-related temporary files
• Monitor for any new EPSS increases given the CVE's age and low current score