CVE-2015-3427
Quassel before 0.12.2 does not properly re-initialize the database session when the PostgreSQL...
Quassel before 0.12.2 does not properly re-initialize the database session when the PostgreSQL database is restarted, which allows remote attackers to conduct SQL injection attacks via a \ (backslash) in a message. NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-4422.
Exploit likelihood
What each source reports
NVD Score used
Quassel before 0.12.2 does not properly re-initialize the database session when the PostgreSQL database is restarted, which allows remote attackers to conduct SQL injection attacks via a \ (backslash) in a message. NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-4422.
- Record
CVE-2015-3427- CVSS 2.0
- 7.5 High
AV:N/AC:L/Au:N/C:P/I:P/A:P - Weakness
- CWE-89
- Updated
- 2026-11-02
CVE List No score
Quassel before 0.12.2 does not properly re-initialize the database session when the PostgreSQL database is restarted, which allows remote attackers to conduct SQL injection attacks via a \ (backslash) in a message. NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-4422.
- Record
CVE-2015-3427- Updated
- 2026-11-02
EUVDEUVD-2015-3471 No score
Quassel before 0.12.2 does not properly re-initialize the database session when the PostgreSQL database is restarted, which allows remote attackers to conduct SQL injection attacks via a \ (backslash) in a message. NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-4422.
- Record
EUVD-2015-3471- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-3g99-qh2f-rgmf No score
Quassel before 0.12.2 does not properly re-initialize the database session when the PostgreSQL...
Quassel before 0.12.2 does not properly re-initialize the database session when the PostgreSQL database is restarted, which allows remote attackers to conduct SQL injection attacks via a \ (backslash) in a message. NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-4422.
- Record
GHSA-3g99-qh2f-rgmf- Weakness
- CWE-89
- Updated
- 2026-11-02
OSV No score
Quassel before 0.12.2 does not properly re-initialize the database session when the PostgreSQL database is restarted, which allows remote attackers to conduct SQL injection attacks via a \ (backslash) in a message. NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-4422.
- Record
CVE-2015-3427- Updated
- 2026-11-02
OSVDEBIAN-CVE-2015-3427 No score
Quassel before 0.12.2 does not properly re-initialize the database session when the PostgreSQL database is restarted, which allows remote attackers to conduct SQL injection attacks via a \ (backslash) in a message. NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-4422.
- Record
DEBIAN-CVE-2015-3427- Updated
- 2026-11-02
OSVMGASA-2015-0175 No score
Updated quassel packages fix CVE-2015-3427
Updated quassel packages fix security vulnerability:
Quassel is vulnerable to SQL injection through its use of Qt's postgres driver. If the PostgreSQL server is restarted or the connection is lost at any point, other IRC users may be able to trick the Quassel core into executing SQL queries upon reconnection (CVE-2015-3427).
- Record
MGASA-2015-0175- Updated
- 2026-11-02
OSVUBUNTU-CVE-2015-3427 No score
Quassel before 0.12.2 does not properly re-initialize the database session when the PostgreSQL database is restarted, which allows remote attackers to conduct SQL injection attacks via a \ (backslash) in a message. NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-4422.
- Record
UBUNTU-CVE-2015-3427- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
quasselDebian:12 |
before 1:0.10.0-2.4 | 1:0.10.0-2.4 |
quasselDebian:13 |
before 1:0.10.0-2.4 | 1:0.10.0-2.4 |
quasselDebian:14 |
before 1:0.10.0-2.4 | 1:0.10.0-2.4 |
quasselDebian:8 |
before 1:0.10.0-2.3+deb8u1, plus listed versions 1:0.10.0-2.3 |
1:0.10.0-2.3+deb8u1 |
quasselMageia:4 |
before 0.9.2-1.3.mga4 | 0.9.2-1.3.mga4 |
quasselUbuntu:14.04:LTS |
before 0.10.0-0ubuntu2.2, plus listed versions 0.9.1-0ubuntu10.9.2-0ubuntu10.9.2-0ubuntu20.9.2-0ubuntu30.9.2-0ubuntu4 Show 5 moreShow less0.10~beta1-0ubuntu10.10~rc1-0ubuntu10.10.0-0ubuntu10.10.0-0ubuntu20.10.0-0ubuntu2.1 |
0.10.0-0ubuntu2.2 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2015-3427 is a high vulnerability (CVSS 7.5) in Quassel-irc Quassel, published April 30, 2015. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.99%, the 80th percentile. Fixed in quassel 1:0.10.0-2.4.