ALT-PU-2021-2074-1
Closed vulnerabilities
Published: 2011-10-04
Modified: 2025-04-11
Modified: 2025-04-11
CVE-2011-3354
The CtcpParser::packedReply method in core/ctcpparser.cpp in Quassel before 0.7.3 allows remote attackers to cause a denial of service (crash) via a crafted Client-To-Client Protocol (CTCP) request, as demonstrated in the wild in September 2011.
Severity: MEDIUM (5.0)
Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P
References:
- http://bugs.quassel-irc.org/projects/quassel-irc/repository/revisions/da215fcb9cd3096a3e223c87577d5d4ab8f8518b/diff/src/core/ctcpparser.cpp
- http://osvdb.org/75351
- http://secunia.com/advisories/45970
- http://www.openwall.com/lists/oss-security/2011/09/08/7
- http://www.openwall.com/lists/oss-security/2011/09/09/7
- http://www.securityfocus.com/bid/49526
- http://www.ubuntu.com/usn/USN-1200-1
- https://bugs.gentoo.org/show_bug.cgi?id=382313
- https://exchange.xforce.ibmcloud.com/vulnerabilities/69682
- http://bugs.quassel-irc.org/projects/quassel-irc/repository/revisions/da215fcb9cd3096a3e223c87577d5d4ab8f8518b/diff/src/core/ctcpparser.cpp
- http://osvdb.org/75351
- http://secunia.com/advisories/45970
- http://www.openwall.com/lists/oss-security/2011/09/08/7
- http://www.openwall.com/lists/oss-security/2011/09/09/7
- http://www.securityfocus.com/bid/49526
- http://www.ubuntu.com/usn/USN-1200-1
- https://bugs.gentoo.org/show_bug.cgi?id=382313
- https://exchange.xforce.ibmcloud.com/vulnerabilities/69682
Published: 2015-04-10
Modified: 2025-04-12
Modified: 2025-04-12
CVE-2015-2778
Quassel before 0.12-rc1 uses an incorrect data-type size when splitting a message, which allows remote attackers to cause a denial of service (crash) via a long CTCP query containing only multibyte characters.
Severity: MEDIUM (5.0)
Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P
References:
- http://lists.opensuse.org/opensuse-updates/2015-04/msg00018.html
- http://www.openwall.com/lists/oss-security/2015/03/20/12
- http://www.openwall.com/lists/oss-security/2015/03/27/11
- http://www.openwall.com/lists/oss-security/2015/03/28/3
- http://www.securityfocus.com/bid/73305
- https://github.com/quassel/quassel/commit/b5e38970ffd55e2dd9f706ce75af9a8d7730b1b8
- http://lists.opensuse.org/opensuse-updates/2015-04/msg00018.html
- http://www.openwall.com/lists/oss-security/2015/03/20/12
- http://www.openwall.com/lists/oss-security/2015/03/27/11
- http://www.openwall.com/lists/oss-security/2015/03/28/3
- http://www.securityfocus.com/bid/73305
- https://github.com/quassel/quassel/commit/b5e38970ffd55e2dd9f706ce75af9a8d7730b1b8
Published: 2015-04-10
Modified: 2025-04-12
Modified: 2025-04-12
CVE-2015-2779
Stack consumption vulnerability in the message splitting functionality in Quassel before 0.12-rc1 allows remote attackers to cause a denial of service (uncontrolled recursion) via a crafted massage.
Severity: MEDIUM (5.0)
Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P
References:
- http://lists.fedoraproject.org/pipermail/package-announce/2015-August/163054.html
- http://lists.fedoraproject.org/pipermail/package-announce/2015-May/158666.html
- http://lists.opensuse.org/opensuse-updates/2015-04/msg00018.html
- http://www.openwall.com/lists/oss-security/2015/03/20/12
- http://www.openwall.com/lists/oss-security/2015/03/27/11
- http://www.openwall.com/lists/oss-security/2015/03/28/3
- http://www.securityfocus.com/bid/74048
- https://github.com/quassel/quassel/commit/b5e38970ffd55e2dd9f706ce75af9a8d7730b1b8
- http://lists.fedoraproject.org/pipermail/package-announce/2015-August/163054.html
- http://lists.fedoraproject.org/pipermail/package-announce/2015-May/158666.html
- http://lists.opensuse.org/opensuse-updates/2015-04/msg00018.html
- http://www.openwall.com/lists/oss-security/2015/03/20/12
- http://www.openwall.com/lists/oss-security/2015/03/27/11
- http://www.openwall.com/lists/oss-security/2015/03/28/3
- http://www.securityfocus.com/bid/74048
- https://github.com/quassel/quassel/commit/b5e38970ffd55e2dd9f706ce75af9a8d7730b1b8
Published: 2015-05-14
Modified: 2025-04-12
Modified: 2025-04-12
CVE-2015-3427
Quassel before 0.12.2 does not properly re-initialize the database session when the PostgreSQL database is restarted, which allows remote attackers to conduct SQL injection attacks via a \ (backslash) in a message. NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-4422.
Severity: HIGH (7.5)
Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
References:
Published: 2016-01-08
Modified: 2025-04-12
Modified: 2025-04-12
CVE-2015-8547
The CoreUserInputHandler::doMode function in core/coreuserinputhandler.cpp in Quassel 0.10.0 allows remote attackers to cause a denial of service (application crash) via the "/op *" command in a query.
Severity: MEDIUM (5.0)
Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P
Severity: HIGH (7.5)
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
References:
- http://lists.fedoraproject.org/pipermail/package-announce/2016-January/174938.html
- http://lists.fedoraproject.org/pipermail/package-announce/2016-January/174976.html
- http://lists.opensuse.org/opensuse-updates/2015-12/msg00099.html
- http://www.openwall.com/lists/oss-security/2015/12/12/1
- http://www.openwall.com/lists/oss-security/2015/12/13/1
- https://github.com/quassel/quassel/commit/b8edbda019eeb99da8663193e224efc9d1265dc7
- https://github.com/quassel/quassel/pull/153
- http://lists.fedoraproject.org/pipermail/package-announce/2016-January/174938.html
- http://lists.fedoraproject.org/pipermail/package-announce/2016-January/174976.html
- http://lists.opensuse.org/opensuse-updates/2015-12/msg00099.html
- http://www.openwall.com/lists/oss-security/2015/12/12/1
- http://www.openwall.com/lists/oss-security/2015/12/13/1
- https://github.com/quassel/quassel/commit/b8edbda019eeb99da8663193e224efc9d1265dc7
- https://github.com/quassel/quassel/pull/153
Published: 2016-06-13
Modified: 2025-04-12
Modified: 2025-04-12
CVE-2016-4414
The onReadyRead function in core/coreauthhandler.cpp in Quassel before 0.12.4 allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via invalid handshake data.
Severity: MEDIUM (5.0)
Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P
Severity: HIGH (7.5)
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
References:
- http://lists.fedoraproject.org/pipermail/package-announce/2016-May/183571.html
- http://lists.fedoraproject.org/pipermail/package-announce/2016-May/183585.html
- http://lists.fedoraproject.org/pipermail/package-announce/2016-May/183746.html
- http://lists.opensuse.org/opensuse-updates/2016-05/msg00063.html
- http://quassel-irc.org/node/129
- http://www.openwall.com/lists/oss-security/2016/04/30/2
- http://www.openwall.com/lists/oss-security/2016/04/30/4
- https://github.com/quassel/quassel/commit/e678873
- http://lists.fedoraproject.org/pipermail/package-announce/2016-May/183571.html
- http://lists.fedoraproject.org/pipermail/package-announce/2016-May/183585.html
- http://lists.fedoraproject.org/pipermail/package-announce/2016-May/183746.html
- http://lists.opensuse.org/opensuse-updates/2016-05/msg00063.html
- http://quassel-irc.org/node/129
- http://www.openwall.com/lists/oss-security/2016/04/30/2
- http://www.openwall.com/lists/oss-security/2016/04/30/4
- https://github.com/quassel/quassel/commit/e678873