CVE-2018-1000178 - A heap corruption of type CWE-120 exists in quassel version 0.12.4 in quasselcore in void DataStream

CVE-2018-1000178

Summary

A heap corruption of type CWE-120 exists in quassel version 0.12.4 in quasselcore in void DataStreamPeer::processMessage(const QByteArray &msg) datastreampeer.cpp line 62 that allows an attacker to execute code remotely.

References

Vulnerable Configurations

cpe:2.3:a:quassel-irc:quassel:0.12.4:*:*:*:*:*:*:*
cpe:2.3:a:quassel-irc:quassel:0.12.4:*:*:*:*:*:*:*
cpe:2.3:o:debian:debian_linux:7.0:*:*:*:*:*:*:*
cpe:2.3:o:debian:debian_linux:7.0:*:*:*:*:*:*:*
cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*
cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*
cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*
cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*

CVSS

Base:	7.5 (as of 26-10-2020 - 22:15)
Impact:
Exploitability:

CWE

CWE-787

CAPEC

Access

Vector	Complexity	Authentication
NETWORK	LOW	NONE

Impact

Confidentiality	Integrity	Availability
PARTIAL	PARTIAL	PARTIAL

cvss-vector via4

AV:N/AC:L/Au:N/C:P/I:P/A:P

refmap via4

confirm	https://github.com/quassel/quassel/blob/master/src/common/protocols/datastream/datastreampeer.cpp#L62
debian	DSA-4189
gentoo	GLSA-201806-04
misc	https://i.imgur.com/JJ4QcNq.png
mlist	[debian-lts-announce] 20180504 [SECURITY] [DLA 1370-1] quassel security update
ubuntu	USN-4594-1

Last major update

26-10-2020 - 22:15

Published

08-05-2018 - 15:29

Last modified

26-10-2020 - 22:15