A heap corruption of type CWE-120 exists in quassel version 0.12.4 in quasselcore in void DataStreamPeer::processMessage(const QByteArray &msg) datastreampeer.cpp line 62 that allows an attacker to execute code remotely.
CVSS Details
- CVSS 3.1 Base Score: 9.8
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | alpine-linux-upgrade-quassel | May 24, 2018 | May 8, 2018 | |
| Suse | — | suse-upgrade-quassel-basesuse-upgrade-quassel-clientsuse-upgrade-quassel-client-debuginfosuse-upgrade-quassel-client-qt5suse-upgrade-quassel-client-qt5-debuginfosuse-upgrade-quassel-coresuse-upgrade-quassel-core-debuginfosuse-upgrade-quassel-debugsourcesuse-upgrade-quassel-monosuse-upgrade-quassel-mono-debuginfo | May 9, 2018 | May 2, 2018 |
| Ubuntu | ubuntu-upgrade-quasselubuntu-upgrade-quassel-core | Oct 21, 2020 | May 8, 2018 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub