Heap-based buffer overflow in Quassel - CVE-2018-1000178

Vulnerability identifier: #VU12418

CSH Severity: High

CVSS v4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2018-1000178

CWE-ID: CWE-122

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The weakness exists due to heap-based buffer overflow. A remote attacker can trigger memory corruption and execute arbitrary code.

Successful exploitation of the vulnerability may result in system compromise.

Quassel
Debian Linux
Gentoo Linux
Ubuntu
quassel (Alpine package)
quassel (Ubuntu package)
quassel-core (Ubuntu package)

Update to version 0.12.5.

quassel (Alpine package) - update to 0.12.5-r0
quassel (Ubuntu package) - update to 1:0.12.4-3ubuntu1.18.04.3
quassel-core (Ubuntu package) - update to 1:0.12.4-3ubuntu1.18.04.3

• http://www.openwall.com/lists/oss-security/2018/04/27/1

• Debian update for quassel
• Gentoo update for Quassel
• Heap-based buffer overflow in quassel (Alpine package)
• Ubuntu update for quassel