CVE-2013-4422

Description

SQL injection vulnerability in Quassel IRC before 0.9.1, when Qt 4.8.5 or later and PostgreSQL 8.2 or later are used, allows remote attackers to execute arbitrary SQL commands via a \ (backslash) in a message.

How to fix CVE-2013-4422

To remediate CVE-2013-4422, upgrade the affected package to a fixed version below.

• Debian/quassel—upgrade to 0.9.1-1 or later

Is CVE-2013-4422 being exploited?

Low — EPSS is 0.7%, meaning exploitation activity has not been observed at scale.

Affected packages (1)

• from 0, < 0.9.1-1

References (1)

• ADVISORYsecurity-tracker.debian.org/tracker/CVE-2013-4422