PatchTheCVEquassel vulnerabilities and fixes
Recent CVEs affecting quassel, with upgrade or downgrade steps. 9 tracked.
quassel has 9 tracked vulnerabilities, 1 critical. A fixed release or vendor patch exists for 8. Most recent: 2021-06-17. Highest priority: CVE-2018-1000178 (score 72/100).
- CVE-2021-34825 HIGH 7.5 UPGRADE MITIGATE Quassel through 0.13.1, when --require-ssl is enabled, launches without SSL or TLS support if a usable X.509 c
- CVE-2018-1000179 HIGH 7.5 DOWNGRADE MITIGATE A NULL Pointer Dereference of CWE-476 exists in quassel version 0.12.4 in the quasselcore void CoreAuthHandler
- CVE-2018-1000178 CRITICAL 9.8 DOWNGRADE MITIGATE A heap corruption of type CWE-120 exists in quassel version 0.12.4 in quasselcore in void DataStreamPeer::proc
- CVE-2016-4414 HIGH 7.5 MITIGATE MITIGATE The onReadyRead function in core/coreauthhandler.cpp in Quassel before 0.12.4 allows remote attackers to cause
- CVE-2015-8547 HIGH 7.5 UPGRADE MITIGATE The CoreUserInputHandler::doMode function in core/coreuserinputhandler.cpp in Quassel 0.10.0 allows remote att
- CVE-2015-3427 HIGH 7.5 UPGRADE MITIGATE Quassel before 0.12.2 does not properly re-initialize the database session when the PostgreSQL database is res
- CVE-2015-2779 MEDIUM 5.0 UPGRADE Stack consumption vulnerability in the message splitting functionality in Quassel before 0.12-rc1 allows remot
- CVE-2015-2778 MEDIUM 5.0 UPGRADE Quassel before 0.12-rc1 uses an incorrect data-type size when splitting a message, which allows remote attacke
- CVE-2011-3354 MEDIUM 5.0 UPGRADE The CtcpParser::packedReply method in core/ctcpparser.cpp in Quassel before 0.7.3 allows remote attackers to c
FAQ
How do I fix quassel vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is quassel being exploited right now?
None of the tracked quassel CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which quassel CVE should I patch first?
CVE-2018-1000178 currently ranks highest (72/100): A heap corruption of type CWE-120 exists in quassel version 0.12.4 in quasselcore in void DataStreamPeer::proc.