A heap corruption of type CWE-120 exists in quassel version 0.12.4 in quasselcore in void DataStreamPeer::processMessage(const QByteArray &msg) datastreampeer.cpp line 62 that allows an attacker to execute code remotely.
CVSS Details
- CVSS 3.1 Base Score: 9.8
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade quassel | May 24, 2018 | May 8, 2018 |
| Debian | — | Upgrade quassel | Feb 19, 2019 | May 8, 2018 |
| Gentoo Linux | — | Upgrade net-irc/quassel. | Jun 14, 2018 | May 8, 2018 |
| Suse | — | Upgrade quassel-monoUpgrade quassel-client-qt5-debuginfoUpgrade quassel-coreUpgrade quassel-client-debuginfoUpgrade quassel-debugsourceUpgrade quassel-client-qt5Upgrade quassel-core-debuginfoUpgrade quassel-clientUpgrade quassel-mono-debuginfoUpgrade quassel-base | May 9, 2018 | May 2, 2018 |
| Ubuntu | — | Upgrade quassel-coreUpgrade quassel | Oct 21, 2020 | May 8, 2018 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub