Security update for quassel
SUSE Patch
security@suse.de
SUSE Security Team
openSUSE-SU-2015:0687-1
Final
1
1
2015-04-02T12:22:34Z
current
2015-04-02T12:22:34Z
2015-04-02T12:22:34Z
cve-database/bin/generate-cvrf.pl
2017-02-24T01:00:00Z
Security update for quassel
The IRC client quassel was updated to fix two security issues.
The following vulnerabilities were fixed:
* quassel could crash when receiving an overlength CTCP query containing only multibyte characters (bnc#924930 CVE-2015-2778)
* quassel could incorrectly split a message in the middle of a multibyte character, leading to DoS (bnc#924933 CVE-2015-2779)
The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).
Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0)
https://lists.opensuse.org/opensuse-updates/2015-04/msg00018.html
E-Mail link for openSUSE-SU-2015:0687-1
https://www.suse.com/support/security/rating/
SUSE Security Ratings
quassel-0.9.2-19.1
quassel-base-0.9.2-19.1
quassel-client-0.9.2-19.1
quassel-core-0.9.2-19.1
quassel-mono-0.9.2-19.1
Quassel before 0.12-rc1 uses an incorrect data-type size when splitting a message, which allows remote attackers to cause a denial of service (crash) via a long CTCP query containing only multibyte characters.
CVE-2015-2778
moderate
Please Install the update.
https://lists.opensuse.org/opensuse-updates/2015-04/msg00018.html
https://www.suse.com/security/cve/CVE-2015-2778.html
CVE-2015-2778
https://bugzilla.suse.com/924930
SUSE Bug 924930
Stack consumption vulnerability in the message splitting functionality in Quassel before 0.12-rc1 allows remote attackers to cause a denial of service (uncontrolled recursion) via a crafted massage.
CVE-2015-2779
moderate
Please Install the update.
https://lists.opensuse.org/opensuse-updates/2015-04/msg00018.html
https://www.suse.com/security/cve/CVE-2015-2779.html
CVE-2015-2779
https://bugzilla.suse.com/924933
SUSE Bug 924933