Description
SQL injection vulnerability in Quassel IRC before 0.9.1, when Qt 4.8.5 or later and PostgreSQL 8.2 or later are used, allows remote attackers to execute arbitrary SQL commands via a \ (backslash) in a message.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | quassel | 0.9.1-1 | — |
| Debian 13 | quassel | 0.9.1-1 | — |
| Debian 12 | quassel | 0.9.1-1 | — |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | quassel | 0.12.4-3.3 | openSUSE-SU-2024:10119-1 |
Advisories 1
- openSUSE-SU-2024:10119-1 quassel-base-0.12.4-3.3 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
References
- http://quassel-irc.org/node/120
- 55194 third-party-advisory
- 55581 third-party-advisory
- http://bugs.quassel-irc.org/issues/1244
- [oss-security] 20131010 Re: CVE Request - Quassel IRC SQL injection mailing-list
- quasselirc-backslash-sql-injection(87805) vdb-entry
- GLSA-201311-03 vendor-advisory
- 62923 vdb-entry