Unscored severity · published Oct 4, 2011
CVE-2011-3354
The CtcpParser::packedReply method in core/ctcpparser.cpp in Quassel before 0.7.3 allows remote attackers to cause a denial of service (crash) via a crafted Client-To-Client…
–
CVSS
2.1%
EPSS
No
On KEV
Description
The CtcpParser::packedReply method in core/ctcpparser.cpp in Quassel before 0.7.3 allows remote attackers to cause a denial of service (crash) via a crafted Client-To-Client Protocol (CTCP) request, as demonstrated in the wild in September 2011.
Exploitation
Is it being used?
Exploit prediction (EPSS)2.1% · higher than 81% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
QU
Quassel · Quassel-irc
through 0.7.2; 0.3.0; 0.3.1; 0.4.0; 0.4.1; 0.4.2; +8 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2011-3354
CVE.org
https://www.cve.org/CVERecord?id=CVE-2011-3354
Patch
http://bugs.quassel-irc.org/projects/quassel-irc/repository/revisions/da215fcb9cd3096a3e223c87577d5d4ab8f8518b/diff/src/core/ctcpparser.cpp
osvdb.org
http://osvdb.org/75351
Vendor Advisory
http://secunia.com/advisories/45970
www.openwall.com
http://www.openwall.com/lists/oss-security/2011/09/08/7
www.openwall.com
http://www.openwall.com/lists/oss-security/2011/09/09/7
www.securityfocus.com
http://www.securityfocus.com/bid/49526
More from Quassel
9.8
CVE-2018-1000178
A heap corruption of type CWE-120 exists in quassel version 0.12.4 in quasselcore in void DataStreamPeer::processMessage(const QByteArray &msg) datastreampeer.cpp line 62 that…
7.5
CVE-2021-34825
Quassel through 0.13.1, when --require-ssl is enabled, launches without SSL or TLS support if a usable X.509 certificate is not found on the local system
7.5
CVE-2018-1000179
A NULL Pointer Dereference of CWE-476 exists in quassel version 0.12.4 in the quasselcore void CoreAuthHandler::handle(const Login &msg) coreauthhandler.cpp line 235 that allows…
7.5
CVE-2016-4414
The onReadyRead function in core/coreauthhandler.cpp in Quassel before 0.12.4 allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via invalid…
7.5
CVE-2015-8547
The CoreUserInputHandler::doMode function in core/coreuserinputhandler.cpp in Quassel 0.10.0 allows remote attackers to cause a denial of service (application crash) via the "/op…