{"id":"CVE-2015-3427","aliases":["DEBIAN-CVE-2015-3427","DSA-3258-1","EUVD-2015-3471","GHSA-3g99-qh2f-rgmf","MGASA-2015-0175","UBUNTU-CVE-2015-3427"],"status":"published","title":"Quassel before 0.12.2 does not properly re-initialize the database session when the PostgreSQL...","description":"Quassel before 0.12.2 does not properly re-initialize the database session when the PostgreSQL database is restarted, which allows remote attackers to conduct SQL injection attacks via a \\ (backslash) in a message.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-4422.","severity":{"version":"2.0","score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.01989,"percentile":0.80766,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-89"],"published":"2015-04-30T21:57:25Z","modified":"2026-09-09T06:47:22Z","fixes":[{"ecosystem":"Debian:12","package":"quassel","fixed_in":["1:0.10.0-2.4"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"quassel","fixed_in":["1:0.10.0-2.4"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"quassel","fixed_in":["1:0.10.0-2.4"],"sources":["osv"]},{"ecosystem":"Debian:8","package":"quassel","fixed_in":["1:0.10.0-2.3+deb8u1"],"sources":["osv"]},{"ecosystem":"Mageia:4","package":"quassel","fixed_in":["0.9.2-1.3.mga4"],"sources":["osv"]},{"ecosystem":"Ubuntu:14.04:LTS","package":"quassel","fixed_in":["0.10.0-0ubuntu2.2"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"quassel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:0.10.0-2.4"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"quassel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:0.10.0-2.4"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"quassel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:0.10.0-2.4"}]}]},{"source":"osv","ecosystem":"Debian:8","package":"quassel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:0.10.0-2.3+deb8u1"}]}],"versions":["1:0.10.0-2.3"]},{"source":"osv","ecosystem":"Mageia:4","package":"quassel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.2-1.3.mga4"}]}]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"quassel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.10.0-0ubuntu2.2"}]}],"versions":["0.9.1-0ubuntu1","0.9.2-0ubuntu1","0.9.2-0ubuntu2","0.9.2-0ubuntu3","0.9.2-0ubuntu4","0.10~beta1-0ubuntu1","0.10~rc1-0ubuntu1","0.10.0-0ubuntu1","0.10.0-0ubuntu2","0.10.0-0ubuntu2.1"]}],"products":[{"vendor":"debian","product":"debian_linux"},{"vendor":"quassel-irc","product":"quassel"}],"references":[{"url":"http://www.quassel-irc.org/node/127","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory","advisory"]},{"url":"http://www.debian.org/security/2015/dsa-3258","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","advisory"]},{"url":"http://www.securityfocus.com/bid/74339","tags":["vdb-entry","x_refsource_BID","x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2015-3427"},{"url":"https://github.com/advisories/GHSA-3g99-qh2f-rgmf"},{"url":"https://security-tracker.debian.org/tracker/CVE-2015-3427","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2015-0175.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=15779","tags":["report"]},{"url":"http://openwall.com/lists/oss-security/2015/04/27/3","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2015-3427","tags":["report"]},{"url":"http://quassel-irc.org/node/120","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2015-3427","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2015-3427","description":"Quassel before 0.12.2 does not properly re-initialize the database session when the PostgreSQL database is restarted, which allows remote attackers to conduct SQL injection attacks via a \\ (backslash) in a message.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-4422.","status":"published","published":"2015-05-14T14:00:00Z","modified":"2024-08-06T05:47:57.675Z","updated_at":"2026-11-02T14:35:42.331636Z"}],"euvd":[{"id":"EUVD-2015-3471","description":"Quassel before 0.12.2 does not properly re-initialize the database session when the PostgreSQL database is restarted, which allows remote attackers to conduct SQL injection attacks via a \\ (backslash) in a message.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-4422.","status":"published","published":"2015-05-14T14:00:00Z","modified":"2024-08-06T05:47:57Z","updated_at":"2026-11-03T02:22:08.106657Z"}],"ghsa":[{"id":"GHSA-3g99-qh2f-rgmf","title":"Quassel before 0.12.2 does not properly re-initialize the database session when the PostgreSQL...","description":"Quassel before 0.12.2 does not properly re-initialize the database session when the PostgreSQL database is restarted, which allows remote attackers to conduct SQL injection attacks via a \\ (backslash) in a message.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-4422.","status":"published","published":"2022-05-17T03:30:00Z","modified":"2023-01-27T05:07:59Z","cwes":["CWE-89"],"updated_at":"2026-11-02T14:43:13.39976Z"}],"nvd":[{"id":"CVE-2015-3427","description":"Quassel before 0.12.2 does not properly re-initialize the database session when the PostgreSQL database is restarted, which allows remote attackers to conduct SQL injection attacks via a \\ (backslash) in a message.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-4422.","status":"published","published":"2015-05-14T14:59:11.14Z","modified":"2026-06-17T00:25:55.043Z","cvss":[{"version":"2.0","score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","level":"high","assessor":"primary"}],"cwes":["CWE-89"],"updated_at":"2026-11-02T14:03:04.906059Z"}],"osv":[{"id":"CVE-2015-3427","description":"Quassel before 0.12.2 does not properly re-initialize the database session when the PostgreSQL database is restarted, which allows remote attackers to conduct SQL injection attacks via a \\ (backslash) in a message.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-4422.","status":"published","published":"2015-05-14T14:59:11Z","modified":"2026-04-16T06:24:52.480716887Z","updated_at":"2026-11-02T15:44:00.594921Z"},{"id":"DEBIAN-CVE-2015-3427","description":"Quassel before 0.12.2 does not properly re-initialize the database session when the PostgreSQL database is restarted, which allows remote attackers to conduct SQL injection attacks via a \\ (backslash) in a message.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-4422.","status":"published","published":"2015-05-14T14:59:11.14Z","modified":"2026-09-09T06:47:22.482899298Z","updated_at":"2026-11-02T15:45:26.752992Z"},{"id":"DSA-3258-1","title":"quassel - security update","status":"published","published":"2015-05-12T00:00:00Z","modified":"2026-03-09T01:23:02.594736Z","updated_at":"2026-11-02T15:46:16.199525Z"},{"id":"MGASA-2015-0175","title":"Updated quassel packages fix CVE-2015-3427","description":"Updated quassel packages fix security vulnerability:\n\nQuassel is vulnerable to SQL injection through its use of Qt's postgres driver.\nIf the PostgreSQL server is restarted or the connection is lost at any point,\nother IRC users may be able to trick the Quassel core into executing SQL\nqueries upon reconnection (CVE-2015-3427).\n","status":"published","published":"2015-04-30T21:57:25Z","modified":"2026-04-16T06:22:20.501655908Z","updated_at":"2026-11-02T15:49:39.488462Z"},{"id":"UBUNTU-CVE-2015-3427","description":"Quassel before 0.12.2 does not properly re-initialize the database session when the PostgreSQL database is restarted, which allows remote attackers to conduct SQL injection attacks via a \\ (backslash) in a message.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-4422.","status":"published","published":"2015-05-14T14:59:00Z","modified":"2025-09-08T16:43:22Z","updated_at":"2026-11-02T15:54:10.045446Z"}]}}