portage-ng / portage / net-irc / quassel / 0.14.50_pre20260525-r1
version « ‹ 0.14.50_pre20260525-r1 › »
graphs detail deptree gantt
cli --merge --fetchonly --info
security glsa 2 bugs
legacy emerge pmerge
portage-ng glsa
2 advisories reference net-irc/quassel · none place version 0.14.50_pre20260525-r1 in a vulnerable range
▸ GLSA 201806-04 Quassel: Multiple vulnerabilities this version unaffected normal remote 2018-06-14

Multiple vulnerabilities have been found in Quassel, the worst of which could allow remote attackers to execute arbitrary code.

Announced
2018-06-14
Revised
2018-06-14
Access
remote
Bugs
#653834
Advisory
https://security.gentoo.org/glsa/201806-04

Affected packages

PackageArchVulnerableUnaffected
net-irc/quassel*< 0.12.5>= 0.12.5

Background

Quassel is a Qt4/KDE4 IRC client suppporting a remote daemon for 24/7 connectivity.

Description

Multiple vulnerabilities have been discovered in Quassel. Please review the CVE identifiers referenced below for details.

Impact

A remote attacker could cause arbitrary code execution or a Denial of Service condition.

Workaround

There is no known workaround at this time.

Resolution

All Quassel users should upgrade to the latest version:

# emerge --sync
# emerge --ask --oneshot --verbose ">=net-irc/quassel-0.12.5"

References

▸ GLSA 201311-03 Quassel: Multiple Vulnerabilities this version unaffected normal remote 2013-11-07

Two vulnerabilities in Quassel may result in Denial of Service or SQL injection.

Announced
2013-11-07
Revised
2013-11-07
Access
remote
Bugs
#338879 #487632
Advisory
https://security.gentoo.org/glsa/201311-03

Affected packages

PackageArchVulnerableUnaffected
net-irc/quassel*< 0.9.1>= 0.9.1

Background

Quassel is a Qt4/KDE4 IRC client suppporting a remote daemon for 24/7 connectivity.

Description

Two vulnerabilities have been found in Quassel:

  • Quassel does not properly handle multiple CTCP requests (CVE-2010-3443).
  • Quassel, when used with certain versions of Qt and PostgreSQL, does not sanitize user input (CVE-2013-4422).

Impact

A remote attacker could send multiple CTCP requests in single private message, possibly resulting in a Denial of Service condition. Futhermore, a remote attacker may be able to execute arbitrary SQL statements.

Workaround

There is no known workaround at this time.

Resolution

All Quassel users should upgrade to the latest version:

# emerge --sync
# emerge --ask --oneshot --verbose ">=net-irc/quassel-0.9.1"

References