A heap corruption of type CWE-120 exists in quassel version 0.12.4 in quasselcore in void DataStreamPeer::processMessage(const QByteArray &msg) datastreampeer.cpp line 62 that allows an attacker to execute code remotely.
CVSS Details
- CVSS 3.1 Base Score: 9.8
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade quassel | May 24, 2018 | May 8, 2018 |
| Debian | — | Upgrade quassel | Feb 19, 2019 | May 8, 2018 |
| Gentoo Linux | — | Upgrade net-irc/quassel. | Jun 14, 2018 | May 8, 2018 |
| Suse | — | Upgrade quassel-client-qt5Upgrade quassel-baseUpgrade quassel-mono-debuginfoUpgrade quassel-clientUpgrade quassel-core-debuginfoUpgrade quassel-client-qt5-debuginfoUpgrade quassel-monoUpgrade quassel-coreUpgrade quassel-debugsourceUpgrade quassel-client-debuginfo | May 9, 2018 | May 2, 2018 |
| Ubuntu | — | Upgrade quasselUpgrade quassel-core | Oct 21, 2020 | May 8, 2018 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub